Cisco Nexus Dashboard Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED ad1a26acf7a8d2794744b8e66ef3dbfea5503ac034145c1363a56c93177fbe43126f42add5479e903ce47849e68a2cd9baf068d9ddf37827386d8fca20868d4c825cadf456827b4c7c46a22e7d19bc9d9489c473422f4a32182dad63dbd153212652adc55007bdd9e3703e09ee941bbd2c51a41787ebaef2734aaa501a26ec40d6c49a2be4ab3da70e744658e647c83dcd65f0d3f4463c3d276ef1e7ed5fd87b3f9a41ed577abfeb7518bac93b82b669abbe407dad9dcd119bea588ad29aad187fc807e928646347b97bc414bf41c2a34cea3160dde424d7ce5aa5642aa629cb868fd79ac6b9935d7644e5ddc8333855a588ed4dfba480fed3038c27f215094d4376f6ea0bdf39c9430fd1a090a3b42a3414b675719b18cdf92c3573a337d08633e7f8d9b32633d4f66763ab0b2103e4c7c4e5ce62947b5133d2405fccefa0b748170f82dec0b4969110f238617498ab43154eb0b1c14494a01f15cee297907b53d221dcae815a024c6a8cf35933e6a09b08df8335fdc8d0479ae799f8bc203c10077f859a41e1c314b7e911f3918ecb8d739f0ee45e88cfad757baa0391c2087f5ce65606bca29858381aa77d6eeadb91f488b05f397bdc661a574631fca267a548ce4126b81504569b1493b62e0e82632eea642d9e7e4a3efe130595eadcc5be1cd0de23ae22d5a06238eaa25663e33addd873a357e1d5f061c8ef768f7cc7
#TRUST-RSA-SHA256 2713758f297453ece80a3878304492b2cdd6b980418462b3de753c2ff50ae5570bb8f98976b9e1cb180e61ed82930be7fe8ac9e2bdf6650e641cc27c60cf17d0eef963ec23baae1ccc291547bf4732077e31011119bdde247810193ce9820a3af012b5028cba6f846a9ea931e93008cc471a198fb25eba30f718982fc19b7b3795208b82d73f9856ef58b9aeb8c2cd80a5731356dd93cf5aa248f1d196b1a9200c211a497bed7d9c872cc47783e442cf2d0782180ca6377a77e8e48fa5756b689c70ad6818cc61c08249eb693542068b2b66c6e2f7319624db4fe47195ccfdff8dad20853e6f6cd7eb99b408af855dd8db8a08c27146a713d987b06bd9b349b7164c9530fb36225e47bcd6dc2b65204a3b835e0959c45c400eb9be711dce8e19044117fe6816469233f7e3741d0e3bd4a5636c5712061b63884af671e3f5c1ea7adc65a7952cca21a0fc7092af0e25428f208d20b9ce9949ae15acbb1e2bbb864356f2679a9cf2473df4b2aba6fb2988820d3763c2e8331b1a2b006e5bbdd83ac269d38610059258e14fb8962d407d6a1df9afdebe26720ae96d680dad18d9061da06cdfb3ffd218dd1c9f723190d3271c6799dd20b3dbfc4e94f639f97c503df4b8051ec62c43aeb939dd37b9ec5f65ca14cab23348b41a197439dd680ac463284459853f88b77b6401a3e025603e0b8b3ab18f2a2c9fac83463ee9340fe44e
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312160);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62261");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Nexus Dashboard Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Nexus Dashboard is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Nexus Dashboard due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62261");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62261");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:cisco:nexus_dashboard");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nexus_dashboard_web_detect.nbin");
  script_require_keys("installed_sw/Nexus Dashboard");

  exit(0);
}

include('ccf.inc');
include('http.inc');

var port = get_http_port(default:80);
var product_info = cisco::get_product_info(name:'Nexus Dashboard', port:port);

var version_list = [
  '3.1(1l)',
  '3.1(1i)',
  '3.0(1k)',
  '3.0(1i)' 
];

var reporting = {
  'port'          : product_info['port'],
  'severity'      : SECURITY_HOLE,
  'version'       : product_info['version'],
  'bug_id'        : 'CSCwk62261',
  'disable_caveat': TRUE,
  'fix'           : 'Upgrade to version 3.2(1e) or later.'
};

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);