Cisco Desk Phone 9841 and 9851 Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 387234b281b58a1ea0f10b294e86e66a1beca56e7bbcb1b2d118fe814af83e1c7d9c66fd31c4f82e84a18cdd363f6c00cf06c827985ac814022fb3f28dd1ceddfc06b3c21a0b756ea551d2765fad45a72fbc9737d3b7eae235ec0ea5358c760e6e4b20091ced35a38dafe03a93ed989382c71b66cb518181faefabde54020083721a7da6643174b22c6e3aa959680dee59882cffb28bc1e845de8be41009fca6f55773ec6129687692e1a73c7bbf26225d0bd7e018f8b816b3f64f6824ee6bb1f02172367046c48e17d491eddae5db4b8423a1e4d5db300dad4950827cd963b9ffb5ca8bf792dc8de5886b1356595fd9add765f722d3adc60e97ee72238c41dac8a3e3acb263140ba713eb35805272a82129f80fabbddba90df84217aeb5a4f3864950044b6fbd67d86edffa445212fcca6e89e528ec636b8d7cfe1da28b1fea74c7607b8843de5ee14fa30821c1ff354ec1a304dbda52d478048fddd746bcaa3e5493fe68f1608881443e6fd209a70217c1a818934ee747b4a6d080afbab922887d2ef0cac0d08d78cbd05a55e0f1a105adde9a7a84d1bde501641011e76145a714321a1affef1cbde0e06f88684c0e34df2bd843245f7abf9ede7296c7189d56a334042dbae9c8d0e612a2b7ed0a08ea1601c1291b49ffcecb25cef490405e71e13304e30a1d29ed7b8520fe367646dc0d897dd9d7e42c94cfcafb32a7df10
#TRUST-RSA-SHA256 85eb77a8998b436876823c0e62d0550e3777f2795a92ec2396932c71205d31d4f8e2ee9adedfa5e64e826e8406b9c47cb525619b6ee2552fa82af913a9da3a6449de80a7fd7f149f0de080cff3f6f480c22ccb516d78b02fa68f3485b060467ef955e5a70f8654ce31d54f53ab1992940885a5be11bcd527ab8d77ed0d4140c15b4cbfaa8071d0085da256d5adc9a2bd11c7a204aa08aa48d31f07873daa68e784c9a0b8992e3cc38a374d882bf60f485cf0f033f5c7ab11eaa76a9de682615eb001ee0cc882aca2b95e92d94194a844e9be0a702636f254d6e3d6be48d4eae5fd26326b1b7dddae14ff562739449efbd1a06b64aab8804e36805df17869a50da687e210f8a3ad647d7e14f0288706a844e08beef4170076e6b240433884b9515575f1b48d3b28980679fe8c0c97d128b8d892a988a5a95fc11638d825010c64517b960e9f9e3b9858b8843d92908f6a832b1cccbd6ed45ba04c0f10fe6c5c7df1a75b3b686499d80e029bb50ee609d63597e59849e6bbfbc90b11114a8e111a5fb22b9c2b5274317eab00770585bb8936770d1d4629b1fe4975a72bd9810a97bff6dfc76a278d460038aae095927cdc4d2e0a5b2836b6fbbacfa9b25cd1686f18cb1f78e9b3d2f46b8d5414fd8548d7c7b3946b56e6532f42373e2a6abbcfd4bc084004b54509004e847561774309756ed5861fb62eee10b51c31f4376273f1
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312166);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62323");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Desk Phone 9841 and 9851 Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Desk Phone 9841 and 9851 are affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Desk Phone 9841 and 9851 due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62323");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62323");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/h:cisco:ip_phone");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:cisco:ip_phone");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ip_phone_sip_detect.nbin");
  script_require_keys("installed_sw/Cisco IP Phone", "Settings/ParanoidReport");
  script_require_ports("Services/sip", "Services/udp/sip");

  exit(0);
}

include('vcf_extras.inc');

# Unable to determine if web access is enabled
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var app = 'Cisco IP Phone';

var detected_on = get_kb_list('installed_sw/*/Cisco IP Phone/service/*/SIP/Banner');

var report = '';

foreach var item (keys(detected_on))
{
  var portproto = pregmatch(string:item, pattern:'installed_sw/([0-9]+)/Cisco IP Phone/service/([a-z]{3})/SIP/Banner');
  if (!empty_or_null(portproto))
  {
    var port = portproto[1];
    var proto = portproto[2];
    var app_info = vcf::cisco_ip_phone::get_app_info(app:app, port:port, proto:proto);

    var mod = app_info['model'];

    var models = {
      '9841'      : { 'constraints': [{'min_version' : '3.0.1', 'fixed_version' : '3.2.1', 'fixed_display' : '3.2(1)'}]},
      '9851'      : { 'constraints': [{'min_version' : '3.0.1', 'fixed_version' : '3.2.1', 'fixed_display' : '3.2(1)'}]}
    };
    report += vcf::cisco_ip_phone::check_version(app_info:app_info, constraints:models[app_info.model]['constraints']);
  }
}

if (empty_or_null(report))
  audit(AUDIT_HOST_NOT, 'affected');

security_report_v4(
  port:port,
  proto:proto,
  severity:SECURITY_HOLE,
  extra:report
);