Cisco Smart Software Manager On-Prem Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 80bce9586cd0a505f8bc89dc0f1aca7c44846b16043e81bd0eebcea9b772eb50be568939937125a0eb4d391761cf6867a79e59d3e819c747dd37c08e888cd5566f86af3452c74572e455e6e97abb34459401f40be371ac574e7befe54fe4b845b0befb2366c2602544d630be4c90d4c562aee29f138256d4225a361c0a2c4451a1006ad168d9051562e3d5cad3707ca9f1f4b0e2bb64f474ed41e936920402b37237fb8f151d675dc30a7b74b22cc344f6897089c8a05c80e21f1a7fcb4799eea75d6aec2022521fddd4dd37ed90638103a2d704438afe5b150006836626d0dd2830907c7813c484f4b3d50565c04c9022672b0077e43094b706a4919854062641432d51f1ab7a2e67fbc6cf198df344ebcb0078ce72bc123cfffe3749010d000593cdc65b76801ab1a7c0bd8132fa2b2195981311b2bd378ff32053e217d5f421b0377f94a60a07f14ee7966fd27f4a7755c815d43d5d14c7b828b331399d536f3bec779c5c38bb9b2a927f07a98823c9bb8692a201d537c1be6acfc124939c236746e04c01c8959251d5dac04a7e08dd846cce13c1406d7e523361a8622a4ad21a735bd933ab568972cf1732f3d58183e7aa6eb9d00380043ac0b87f5e1f057e170b907c23b67697d47462f651b6ed620e0c936dd5960fa8a3ddb312a9a0f80ac41ab17b62d6232bee4e8ee79429605a7bec038d6e309d1a6b7ff41e89fc1e
#TRUST-RSA-SHA256 a1ec24c70f7407dd91390992ccb5457eaa52a0f4f889e798f14ecf276268334b38ee984208838f1e0950bd11932fbff88760b8a1ebcf9dc035c1807a3eb2c18b1b2c3f1868ab5db56aa9bcc34a50ce389e786c63536871e6cddf75f13418c7c65bd98fc703ded64a0f847296a69d5345ea2b8c7d13ef633e3910f1e1389bf26523623005c6264c39af90725b0b9c7e615b6b1583a6254c508db3b9fe3ff1ce22f1e1595b992c4abd440b32231e39c93a18ecd2aad80a39b406564dd6e2429c9613bbb7a6d9b77d87f6dad4629e6b65ca54966fed401f990cf27f21d1916fc1a2e30b9747b2c1c1581dc4ca7f0a38d74c02ad5db7fe8a9b6262b476a455239e2383e3f99de78522cdf03a84ecd0ea7eb23888c81e75a41852ebb517942a0fbfde6dce59136caa3930173ded00fff41d7f496adc503f61093a165c55f16a263ac98d0ab5a6039e65cd6781a6076b3ca5b8406589aed5befa097edfbc0b1b986332c1c397a20f180a429b777f4edc5e8d33b7bfb2d25f80fa1112cdbded112e74e78858b6f59b7597a570b4e3193083cf46b8578947d255fb66c62e4f3bb0527497e886abb554f0c9d42c1dbd4612a01ca0c5e54f488ad16dacef6bcf44a8242b7a1ea91a8977ff1a894cb4019afb581f6229273b83c9da5fd739cee44685ad15d31e5a782a90bda860c69c43320c852996bce8377f2e862daeb846328bb04a669c
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312162);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62288");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Smart Software Manager On-Prem Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Smart Software Manager On-Prem is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Smart Software Manager On-Prem due to a signal handler race 
    condition found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd
    SIGALRM handler is called asynchronously. An unauthenticated, remote attacker can exploit this to call various 
    functions that are not async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62288");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62288");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:smart_software_manager_on-prem");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_smart_software_manager_web_interface_detect.nbin");
  script_require_keys("Cisco Smart Software Manager On-Prem");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

vcf::cisco_ssm::initialize();

var app_info = vcf::combined_get_app_info(app:'Cisco Smart Software Manager On-Prem');

var constraints = [
  {'min_version' : '9-202406', 'fixed_version': '9-202407'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);