Cisco Prime Infrastructure Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 2120ae55b69b3b5e65a81ff965f5f88b17836dbe994d25f5eb62bfd6dd83aa5c6ae34012449184d92f6f877646ec0e210c947187f2f8137df8368414dddaf11fa27fd0224d0848a0977470fe9229749d3d0cbd2d9278c535b6a42a6fb2fbbffc2f5f816452dce9aa9358b882ade9c17a90f395e73f7db2d668788b8f6ecebe6f086a21868384808f697fc1674404cc86de6444d5055248e322e0b33156241ee832cad091ec251e04c87fa81c604c4874c6b22b06082b95307bcc36322392f8da034e586e1af136c28d59c59db2b2f25688d838770e64be8716ef18a68efd33a887062ff6be4fb9ebe61620f9e9dc9390cd536eaf90cd01f365affb5c69463ff16320e3c913169a66531ccf7101952b1114de607385ea9e9c4215d52b07b8f9007b16d8e9db648b2974c4660ebf426c7219b9ce3490ee3e293fa9eef2703081295dbaf651e2ad7a65a3ed6188c07af80ac2d93e0b27f19098f8a2df0f30e5f601c9e32293d390926e92c5c6cb42464d2b0928534542cf8153218f0f23533a7c5fc4b03509c3f75e96ab16c9ca1981cd076899a9e8814c173f2dd4e5f737b66574151b74e84144ca9078c142d907ca329f6e4227cd2ba0975a08385098f1d15d1cc424efcb693fae649e77e9ee0d329e92ea99eab99c875abc701366299b7532d81ad4b8aa7a5b5c405b087a76f163024f5c6ad3dff958137dea646d48cdcec101
#TRUST-RSA-SHA256 4968cb0713f2ccd3de0ec3516bbbc73d0b853d275e9194fa8b043cf0283db4bf2fc8b00d4c7b30609386de5866f9c937fa0c6a4cdcdf4da3a68802151d49e3fe980d7f3a6c59dbd71f87a26a9127cf28ee13dfd5fc1fba2e2f5ff8b149dabbe29aec30f3a40466ce9b126e9e67ceeb740ed48cf34a8dda7df5277a6069bee8852af6e87c98b204247dbc2c1afac3645c6902e80298f324b3c410a49aeb8e795ea31039064ad27b64c7ed84b5ee842defd0a754cbbdf19999133e64293851247000859d9f14cd224c6501ee6b887931562798cf546ba95d4d19d45ae5ec57a48c8c3a3b7330a5b33c02470022018825bd17706a81a9645a69e600f5f779285a017523acd1752636f7f367a763a2126ea225ab8d8476e727225a4037d6c862753c3f04ace2090775faf4534dc5b598e0582238eba1b02ec8fe237c72d47ec7b1c8e097abcce415ef52f513250f64dec8c143336b94302f4fb3c17d590d95a3dd8cfd4bc8a498cf9d72d6f7585d2db9278871f300fe8926b29cab93becf9263366f0151684401f59ba95aa1a04952ec13c170559234222090e2665c70a179e3ea5aeb8a14bd66afe21ccaadde30cbd66f87b4e7c544126a26565231b37e947427749be457f8147356784de18161ab566f4fcb210b11d243d2ec34d5c4858b78417d6d0ef9968255cf5579ee1a877eb2829419c5c9c7468b936acd143e5ff2ebeb01
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312161);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62276");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Prime Infrastructure Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Prime Infrastructure is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Prime Infrastructure due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62276");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62276");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:prime_infrastructure");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_prime_infrastructure_detect.nbin");
  script_require_keys("installed_sw/Prime Infrastructure");
  script_require_ports("Services/www", 443);

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Prime Infrastructure');

vcf::check_granularity(app_info:app_info, sig_segments:3);
var constraints = [
  {'fixed_version': '3.10.5'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, flags:{'xss':TRUE});