Cisco IOS XR Software Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 4038cf4a9f8c4dffadbbd2945795c5562baa9829a24d938b3d719924242e8b75042b9ecc99390d3b6108f58123184d20199ad823ce9ae94d3e52c926b7ff918a22e771a5b6c590261b9311067129f1d763e4291b260beafcf957e1941eba3b873e36f5fb8d9ed04517c2facc374be012890e3d2445c6c3814b32f1b79b4e4d7dc0d6bab45a367da7aae57e05c45acd1ef628d6f339f06a1e0e0b4b9d91407e015116fd62e43594352c0ace2ebd79f37028e610e15b003691553732f4b65736e3104351dff091876162bc1be39aee20f3a5d86d0eef30dce96684f6a987200309b485e0594201d7729369602c4a82d728bd06bed2f42390b476999551f70b4e006333f579ca34c538339bfc060eb022b79d858f118422b4809d0638bda493ce2a512f5b8bd6460dee3c19a00ada15d0db7c0fd2a6fbe52f51567d4ef0a0ef1ed8a5a6228a5ada81ab594b67910bc2cf02773c2589731346ad37da382a269d632637d40b62fe0d088dc8123686dd412c0080f9576ab461ba8b99bfbc2a3b9547e5aa652aa33c78e27f99de29311fc2683b35369d82446696bd0d11996c708e050fee191e17c64b0f0d283735ef70057bb5d33a47d3f710dc3435edc34b371b7411cfd9bd809517e6413771851c7ba95beec09ff05ec77650648f524c9232362bed766632be67e8478f25ad54461bca5cdee68ddc21a1a49c7811da197b0da528f6
#TRUST-RSA-SHA256 83ae4d0e18c645dcdb1183b97fd2b246ba2ef0d2018979d7347d5c92ef60548957e67143e5abf6935740323a73659c67910d45a7df83b8e12cf44521026c5342cb03d25c9e87c7ccf2b623b796dc0029e210a9b5d42c50a86427928bb3b13d6bc523c66f39f103b519f5cc57d895ee9f67bda1fcf0495d57390e88e2377aecf31a74a3e633d75e6d2f5f58781c933008ace7f2a0922bfbff4700da448944fafc241f760e563e02b7fa7820e8326b77bc78a06a43805869f69fc8f7d0a19fff2949e436f318595e4839c7e51b7291e4a24f11961025e098d69dccb3a7d2f50a9b0e3a3d7eac98e9f4a336688e5780cc012cd0bc5ae832c1b47a5fec34f27fe542b716280062b466ecc5c6b8ed7d6262295688808d759f62b7cfd2b79cf2aae1e09f936bdbcbcce3d63635d357e151d4614a9d7e03a1d8d15d87735bff5d416398c08b65ce54e5aaa0a4e26f868c396ff0a575ab140d7924d8c683074d20710d92bff3bf193321bd49ed35ddadcc43a1713f9963414bf6d3fbbe4f16d747722775596b3c962745c2b83139681df2366c47f74339bbdcfbb6a66cf0bfaba35a5f5023f7fadee389559a8b8ffdcd970066abcb546bf556fcaa476f1d1c9e6a797c5216135b9612ebdbb8608e2355c0778aad1f1d06e14a21fc6c74810cf0342192f8850e5954068b0c22622e5eed9f0e8526ae726b3c929b419c6ff770d33a31aceb
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(310725);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62108");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco IOS XR Software Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR Software is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco IOS XR Software due to a signal handler race condition found
    in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62108");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62108");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl", "cisco_enum_smu.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version", "Host/Cisco/IOS-XR/Model");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var model = toupper(product_info.model);

if ( (model !~ "8(\d{3})-" && model !~ "NCS-1(\d{3})" && model !~ "NCS-5(4|7)") )
  audit(AUDIT_DEVICE_NOT_VULN, model);

var version_list = [
  '24.2.1',
  '24.2.11'
];

var reporting = {
  'port'           : product_info['port'],
  'severity'       : SECURITY_HOLE,
  'version'        : product_info['version'],
  'bug_id'         : 'CSCwk62108',
  'disable_caveat' : TRUE
};

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);