Cisco Unified Communications Manager Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)

#TRUSTED 72e0f04dc272d4af3193099d5037d116ba24c53b328084d6a37a05f71387433c791bede8d8f194e4242e77a7715e6e3ef0ebdf56b0b970c2ce9a02d7bd10dc6c35fd8ddf18d433f2562428e5adc805aef867b8fd2c503b7f8970eeb815cf72fc4919d91b6cc10d9d2ff68c4fd0cebc86a79a7e73027487de5ebed060f7871d86d57810333353b02280a4a3d4a0c9862b90f6098d82cdebe87948620329bee9e33d1a6675d95a827e271339329f293a737c5248c9545f3d31f4a0153a12633ce693368ed59dde7c9c07e8061cf3efebd9becdf18fe24f9c9b4c3514408638790c40ea52a9b28698348f7118054155e90b24435aa995c4e2887d50cc7c49362ce44099228799f0fc008033e2c1328e8f064136cbd92c95dbaeb30430e18535f8447e03b3fd001c8f1367de0e1546dfd26e82731673ab8e28cdbfa91296911451d72ea5885c0dbaf8d0fddf94d1c6511149dba59a5a96074f523512820b8c11ebb1ae4bd6e11e82eb4354c8d4e343655014e9de4320421c32d7bf97581b4d9e9c02275c3ca54e3d787eaf8767fb675331e9e9ae3b2526380c5c5380a49f4358e52dea094d731fe0c26a96b8d30ea976a7d8f5389199a85fec8b9ac6c6443ba58b850130bc01070a3230b3ead70a56f222de408f387e4b7b0092d2c7ea5c19fefa7066fe5d7ff950fd546f81b85ba99862919e13eb4ece448cdcbb0f3d970e21f96e
#TRUST-RSA-SHA256 358b0abe26b09533905d80045ab45efc2e0e57a777dfe524f1d2c79cc50220accb9a06236d2b4f985006591e5581b4ade6f2ef28b1532c8ec553cf6349e1f41dea8c31882a3578d95a732322d8d1807fc15df3cfb665c41771e9d8d9fa83e554de680f0c926c58e1b865b01fcb06759fdbbeb4de6c8a0460ac31928b8ea4ccde2fcb56a698248be072213e0e7296efbd123ad28d8f3803c56624f8c64046107f4a982e05e5f18854c1bc7dc7d1b8faf3a3bc47533c622b3ab6b96924aa03a8cf9180abca87d8251735ce7ab0433b6024a41c5f5aa1c849e75e1de89b3b842f67952df7a74ba3076c14fb7836f74c0a628fa7af5ddb8a53fc786a3373354c48019df3ddc03be71acf20b528f866c2b9055f98338b92dbb33cadd2a99e1627ea98661ad7a8d4612513ae35dc7d45e81a331948b87f97d733fcb9782891ef3ec86f7b58f8abdc150dfcb7e569800f57e1e507e655078a562cb58d9d313c6cdfcc3487c9f9675052177253e7e71aebe3e43c733561af1ee7e419b468548d5e526b49242ff9f8555eddb582b89cfda40b1c42baa6fc670aa5efb508932bac37a5a465f6803140bbc16c27e2705a1a1a33ccb88a64530903ec5691d8e94eef574baa7e06e8047934650b939ca63c33447293dd71002f41e3fb181b9ab031793105dbe3868e105e0adfe1a4c5bbc44200ecfb7431a7f4257880137fabc0ff3beb006942
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312366);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/07");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62318");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Unified Communications Manager Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Unified Communications Manager is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Unified Communications Manager due to a signal handler race 
    condition found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd 
    SIGALRM handler is called asynchronously. An unauthenticated, remote attacker can exploit this to call various 
    functions that are not async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62318");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62318");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/06");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_communications_manager");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucm_detect.nbin");
  script_require_keys("Host/Cisco/CUCM/Version", "Host/Cisco/CUCM/Version_Display", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');

# The advisory is a bit all over the place for CUCM. Will keep this one paranoid.
if (report_paranoia < 2) 
  audit(AUDIT_PARANOID);

var app_info = vcf::get_app_info(
  app: 'Cisco Unified Communications Manager', 
  kb_ver: 'Host/Cisco/CUCM/Version'
);

# Cisco seems to follow a naming convention that would suggest the COP will be named after the CVE.
# Adding logic to catch this in cases where the customer hotpatched but never fully upgraded to a fixed version.
var version_active = get_kb_item('Host/Cisco/show_version_active');
if ('CVE-2024-6387' >< version_active)
  audit(AUDIT_HOST_NOT, 'affected due to presence of hotfix');

constraints = [
  # 14SU4 - https://software.cisco.com/download/home/286328117/type/286319236/release/14SU4
  # Cisco re-released this branch and never incremented its version, so vuln ver == fixed ver.
  {'min_version': '14.0.1.14900.94', 'max_version': '14.0.1.14900.94', 'fixed_display': 'See vendor advisory'},
  # 14901 branch was fixed with a COP file at the time. There is no reliable fix version for this branch in the advisory.
  {'min_version': '14.0.1.14901.1', 'max_version': '14.0.1.14901.999', 'fixed_display': 'See vendor advisory'},
  # 15SU2 - https://software.cisco.com/download/home/286331940/type/286319236/release/15SU2
  {'min_version': '15.0.1.10000.32', 'fixed_version': '15.0.1.12900.234'}
];

vcf::check_version_and_report(
  app_info         : app_info,
  constraints      : constraints,
  severity         : SECURITY_HOLE,
  require_paranoia : TRUE
);