Cisco UCS Manager Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 54e0b847c3d8f897c58e65b92f9edc100df7f381b756f03672ddfcf2982d201ec6373e89d87b187ee79267559392719c7526f19bd1b116a49d7831d94b1a4035efe61a523843f0af4c3ee57fab726ae1120c151d915168ff7295acc36cb45ce363143ef0ef816371c79a495c40f8dd0eb6cda9b34c8bce143db4219f6cdbaffcb59ae45004fbb467286881565425d588c8e15ff21ece3cc6f72086cafb7a02f209bbad2846f118aaa177d9e9bb43b9e4173ba235dedbe2e0bdfce8c48cd793b3c9904f7fe6a1debaf062d612152ff3ded42f4e185a8d69fe36e1e4fd90e6c24974b9707ef4e2f7f5643be1d399ecc2ef12892a1b0ba52cbd722f1df76a8b30d967f895fd578cc37cb84c6c83636d804de1e94cc577131aafd1cf660410875f983ac332daafb4cbab5f9bc23a8808b8e7fbf52be2692408889b497d67834698aa22cbb166fccef03b5623378b1412169af1ce016de0dfd8e82e9f269347b0599333b83188cda7f6084170c20eeef0685f4522839b72ad239ebf4add902e33bd08a6d47c2910ec80caab8e5bb64a0a7c46bd513586d5ea6d9d9bff490189421b957e4f38b3ac54f8fa9a97f4c97a783f92467a49be93ea3c49adfc5c8e6c1c501e247f200cb32275ed4f8b8048dc8d6770bd517bd1c8902ae94f53be2b76ae9c253b5f647c2946223c27d4777653d31aa9105da7edc1d8c4d937808c40626ae81a
#TRUST-RSA-SHA256 8da9116fefcfc84740f00313f4435faae9a2ecb324fcd340c58f5036446a76e1c8b2999d0f5789429a27755632c7c48d55741f4c0d3fed9f990a81de55f655b1dab2ace149417eb9f49a86415ac38f302a0d0676a47f2027ca6e6236461532751dd2ac8b413b59c085e7f2dd989406102e80c5a19015b1b6da1e91038b790d0472a717e96ebc223e599a1911ad46988d370bb4a0f8595a726fe096163a2743048064d269994b50d11755288fb5eba09d903e6fd328220e29394c642f97d940386f21f05da07c6c40cbf0296be5bac0888f39a017d5b1305aa8342f69d5f390ef5e70b03ca9ad5a8453767a0ef567a9ba6f6003874fec2de50a54756f3ebf82beca7eacc196e982b9deeaf16a41de26fc3e4d11c8b735cc1b22af730c2d440a696e1995115d94c5bf227f14ecc1621018f5607173772ee585a47232a65d539e0f9b3190b709bd3ba030ab1989a71f28889c0c5b788227688e9bc8653d0a3264d66c755c10c2a6b93204f0cb7f6ec631a6b12baa0efce35975769c72cf08c3ca3d2a4a337ff6654605f5f204bd24393bae7734833c199f753c5935c56dccb9bb6de2ebccd3e8df7fbefcaccad214743be499a797cf07e520e44a94066bf53e15e931a4053fecb818bc67ed84a77e649e835a3ae3fc8ee261569a6e4944fced90228160d3890bf78c137931a58c4e62eb64294f0b84a8efd601fbbe140ffa8a6dc8
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312164);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk62264");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco UCS Manager Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco UCS Manager is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco UCS Manager due to a signal handler race condition found in 
    sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler is 
    called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk62264");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk62264");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_computing_system");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucs_manager_version.nasl");
  script_require_keys("installed_sw/cisco_ucs_manager", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('ccf.inc');
include('http.inc');

# Workaround is available, but we cannot check for it.
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var app = 'cisco_ucs_manager';
get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80);
var install = get_single_install(app_name:app, port:port);

var url = build_url(qs:install['path'], port:port);
var version = tolower(install['version']);

var product_info = {
  'name'   : 'Cisco UCS Manager',
  'version': version
};

var version_list = [
  '4.3(4b)',
  '4.3(4a)',
  '4.2(3k)',
  '4.2(3j)'
];

var reporting = {
  'port'          : port,
  'severity'      : SECURITY_HOLE,
  'version'       : version,
  'extra'         : 'Version source    : ' + url,
  'bug_id'        : 'CSCwk62264',
  'fix'           : 'See vendor advisory',
  'disable_caveat': TRUE
};

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);