Cisco Secure Email and Web Manager Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)

#TRUSTED 7f90db2f94a12ac6c0787fdce4b290e8a38c87fe9ad38ad730277c91787be009a03fc94099ade0b8d33bedadb518c20c9998292d23571471943311c4321696e1d00c66409b704415f9c7fb10eba95ed1d3d2fbb6c27a75d805640a711da8e05f7f3b3c6d262fe6047a822afcf12c6efb36ae7bab3371190216ec2b57a8583de680dc11f81d86f00a88f006d12d36eaa3e5e33118d360963b58eb39596dd37a7dbb807630ea71d747ff698d90100646b84800a8426c0d35cb5e08b3b54ed45e7c4f7a0ddaa442ac08ac8f20cf4df77ed004afa35b87209d11baa3c69ecc1f064a9465061609e13b295975a19530646bb5cf3be70cd92fe26f84a2e9d084ff543e380f1033246a94026f18a65e195e27f9612c03b5acd5afef91a08fb08b61c23cdfff4f0ae9f66d04c5282215c9bb30e6b2db901e6f21241e5c57e1194138830ed4d64a400eb562a4fc16a1d74d0e85126e62a2d3de3267bbb17ea72f3a9b05f0900a668f351d51d5c400a258f547fab72d1e79faf1ab643159b1a01d2c462fd08b5f2083f4a3a9f13253b7a5f2b3c4f2e7da41b2381a442322cf27519dd90dbcad3fb913e7b47f6bde1255e58fbfd8de132f54b68e606588d41cfedaa75151adefc14211b850ebbf9f8141f9607135b078821f436ac18f3f461635f0701dc37e7bb98c64e4c3d5acd1443651961e3eda760d648b56581e3c046565d4cfddc169
#TRUST-RSA-SHA256 67f07d7e57c6c57d9c3068c3881bdc9f705221fd449a1a5efd96fe2f51108aa0208feb6d5a37a51419f0f7a2b8205e7f6d5ae57d8c7e3014c911ce3e5d43fd56d3fb7bdc1bae99b7037fca7f5c437e304e589e3db5677ca08ccbcdc21b00fcd1d5c256ee678dfc6b86bc3d52a0eb8d1c9476f67fc2c3ba02411bf59890553ffa8ca9bb67b020baf9df535aad223f679e5eae9e4920118a5e42e0e46ad89e89e40cd3fa828189fca05dae7d21cf23cbb23ac33c51bf6f661e4b75ef3354d379a9f64ba068d005821fd28348723bf56db3ab921d8a462f2a66414aa98f3b3f284b762264ac6e0aeaab10f67b8ed5efef3bf91e394691d505769ba25cb774d97a787b79c21bff2e9a29c1d7220b5b077d0a674f8d10b769ed1033482741e0743bc56f1c9cfaa4ceae0026baa82fc5db49b80fe8539c34de77ae47caa1fb62501b4d2ffe61ee1e99912201fa942078b85ecba60914bd487f19fc2100605d22465c403dc7ea3b69fd4ebc51b8804a669756e4238a5f2b12a96372fb80d5e6d4fb2b280808a50577e03a7e2527b74657e7cae4421f83a22c7fbc788576e49ba35791d1049b4de442a11641316ceb814e18c0e94095c3f48078e43bbf57cba3f744612802ca74d671d33fe7bdff155201b33ac0406711d97590c8e48647b1aaad53ab0ad1f00439d337883de499e40520f904a5bd27d700efa6ddaa13a292ee79e6e916
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312157);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk63532");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Secure Email and Web Manager Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Email and Web Manager is affected by a vulnerability.

    - A remote code execution vulnerability exists in Cisco Secure Email and Web Manager due to a signal handler race 
    condition found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd 
    SIGALRM handler is called asynchronously. An unauthenticated, remote attacker can exploit this to call various 
    functions that are not async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk63532");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk63532");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:secure_email_and_web_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:content_security_management_appliance");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:content_security_management_appliance");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_sma_version.nasl");
  script_require_keys("Host/AsyncOS/Cisco Content Security Management Appliance/DisplayVersion", "Host/AsyncOS/Cisco Content Security Management Appliance/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Content Security Management Appliance (SMA)');

var vuln_ranges = [
  {'min_ver' : '15.0','fix_ver' : '15.0.1.035'}, 
  {'min_ver' : '15.5','fix_ver' : '15.5.2.005'} 
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwk63532',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);