Cisco DNA Spaces Connector Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 784b846d44a327e202b00bbd22495a7a87cc9f3c862ac1b0b77dd2c5d7d554d323949da525f27eb03a2e0b88a45014c472da2063a1b99e63201a7127df14769653693d1909d1a0de0175d79a9a49ee3d97b7fddf99cd68559c44c63530bd7ec9e8ca79a7f83c6525534e889e0ac5af188eea6bf0ba3f10bfe43a0d2f162fb8368839205bb7263a9b0c5964824dbac31911034a0220ba3dd455a6c2bfed2df059f1b81e13c5b096f26339219e88fec7bd14cc1c24f1fee0c006c73a69c687c5da1ee3bcf99677397dc1e2ec2c1c632f05bd0135eeffb89035a65603a0386f6f813f938dfbd21debe25bb19c34c0f0091dad0ed1ae07e6b9cb95eee01fed3c1ffb9e15b5db3921fa1aa0365c61f8893c6ab1601ec1aed37ac1827d7a7fccdca78454f9bbc1d40d64c02d3186ed96d45809362a924ff97243e5ee7bb2f90fac35859a05ec7dcfa90ff408ba74bc7602e0bd2f43f5c6130b92c5f72a921722693da1e434982783db2d54703a506f889cb29fe7c9e9ecfc0342501efc9879d6c3d9e7d5dbb352a691d2b9a1a78d183219cc3a2fa0f5bfdf0e7b434115e0aa335bdaf202291288dc1aef11a9d3fb9903d44fbe7b2c2e47efc49f1b70645d2a3b5e2f910fd5257fd6162019a870a66e2b7386d6f004c1cf8a714d6de620e4d97e2adb0c947b4ecf40a43ff8bfcfd4ede5744690124038ea8a3b4088a1afa12a65e14090
#TRUST-RSA-SHA256 52141dd694278d383a5c78513e55c077194fd7fb3fd0cfefdc98aea360314bb4ef42c3e44ad9a3794c0de01693f55de50bcfdf648ae1c7988067bfaaed678ba04267d217001dd39f77cb54a4c0d4accdf1bbea85145712fd05daafa0a2759fbcf61d8216e14591e55be8f31fbaf4e0890b2347bbe0830c9fa197ff20294464974e8970b0a1d3db9487d296877d673c042b2679df52d52b32fd0dcbf274fe2584b6c0fd64bb14b4fd73dc8f620f24ab4dee502c956f38bfd021f8ebbfded7cd3a95c907138a96550166ba106840a9e9385a0379e1bbc249b2be0f4d2265ddf961bae50e09697d86a50abdf79b08f06e7bf58fa5baf80fc0ded92892f01f0b123f09e09510c84c51cd08d90dd7ae5995670ee6b721f9735ffbd2a5167302b3162b73c56aeece374fdda6f88823cf4f79b4ccef1bc7513e1d4a4891aa8d925b80f3e3fd00ee69c4782c0e20b26b39cf48196fb2d4f127d0a5ee001963146af7d0333cc5888c2621c28ce7f2968681d9c7404e30a2df5a274d5069b6f4bcf353930dd1e1045561cc0230f3604f74c13b54eceb06df9410a44164af7ea4ad63fabb5551bdeeb33aa924f4dc7fd51e5f1faab3eb4f685e599b4b003bb0ffacbbf13436f0f71b1bae0a1d6a7b68c24065267d10f1b15ba85b7a27907cbfc7a4d232c8d849299f643e43942c692841b100d14f14bbd2c4b420792ebec21a8f06f102a6e3
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable Network Security, Inc.
##

include('compat.inc');

if (description)
{
  script_id(310140);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62273");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");

  script_name(english:"Cisco DNA Spaces Connector Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco DNA Spaces Connector is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco DNA Spaces Connector due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62273");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62273");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:dna_spaces%3a_connector");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_dna_spaces_connector_web_detect.nbin");
  script_require_keys("Cisco/DNA Spaces Connector/Version", "Cisco/DNA Spaces Connector/Port");

  exit(0);
}

include('ccf.inc');

product_info = cisco::get_product_info(name:'DNA Spaces Connector');

vuln_ranges = [
  { 'min_ver' : '0.0', 'fix_ver' : '3.0' , 'fix_display' : 'See vendor advisory'}
];

reporting = {
  'port'     : product_info['port'],
  'severity' : SECURITY_HOLE,
  'version'  : product_info['version'],
  'bug_id'   : 'CSCwk62273',
  'disable_caveat': TRUE
};

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);