Cisco Expressway Series Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)

#TRUSTED 65576d43b05c4fcba4970b7bfa6011c26f514c1e9dcc4925836f40c4a1dd542f8b81623db6a26cfbc19b59a4a7bb3a874b1d888163becb96c82dd31592c6265b1701c0108394039ad3dd7e70f6150d3f469175b846b143647657490b32ecd023d8500ed0d988ba2846606adccd91c8e5a8f54a9615ed3591a53d0e87c18d5c0e2b3208b942e6f4addd93a18798a0054d370dd41d41e65634c494b93cb413cf93495ef59c3eabd3de044eeac907f304f83c767fcac465bfda5157c4794e7f508c8273b957cfae2688b1f6b62d4806644211d53602f9458893b87c2add8a5a74e420d8584a6d55a724d29a44e19ad462ed9b540b61d0a0b2831c8258a65c02cb4b7627a42fca50a955bd3c4c265b7df5ccc898b321b4205d4470525b732e00588e248e397c470cce1c4372a2e2c01b6e5839a71c44d6b0a0dcd8dfea67fb82e954f526c5cfebf28ea6fa3df400f2ed0efe974ea1c290ce404811149fc2e747907cbfde0a156db4dc929dbb4011cde67fe1b71110c3c511e1a4a2dd10d2d6eb6b1cd3345ba0cc8acc616865c4a43753fc244bafa50b3b932268cc50b9c6e9284ec08b1465112c4076da9731d49647e8a536061af4f48ce638e4eddcdcaeec542d90ccfc377c57b4ed471297faf1d9c5708d7ee59ae126cfb27a3eb6bf155ddcc8a2a7edd8145adb374eb641e7bfffcdf75faa2e5b6b37bdeb028a7f41a456037a83
#TRUST-RSA-SHA256 21350cd9c7112ebdac86d92369518ed966a4d33ef462c9030ddd40daec422359fab66fe6b80c27cf16f6e2d16cf7bf92787e416445d6129ee64dd583775b469c50fae1ecd94458b50dd6d59c5a997e768cd4e14cd85bbf0a9df306b6f685b57e9f938f1e9356e9a671af1a9250b7981b401cadbeb991aacbf076b5cf2f47727b639a7f0fdf6eadab36f0636cc597413c30294e2d2b5563e4bb3fc7469cd4f4755aa3360216eff4176e3980954b20cfe01db4e812348a039bb6d17fd7c0ded779c0a71bc08ca99b7d03f6c6cdafd59097c96a5c946a5f264f15b860213ea111c55095ec98d1d36e5123539da57b553d7ea874b66685554e31ec1f2b96025b7b0f73b3295a4d4397ace5a5ecce5dad96de4e4ff40258f147f81f7fb015b8af8f5bc1164c45eeab3cfdc661c52ab3a4e3f78c86d959e32bae838881a8caa320ddcbbe5e1e018c9648e20b6853d2976ab16329b3fabdbf355f034742815a6917b376ff64bf789ad25984af5413f24227e06bebfdc0a9bfcb1466268c53968b92e880fd6cf4f5b58be888a3bdd1cece21e447053690f3674875ebac747cc17c317d739cfa5be07082aa60b83eb9d86cb97ee4070f533047649032ae29d47f34a7b76ce89c7ec0b56c9f7edc8deca3597992487f211745f7e4aa2a3659a55e998c1736673c3ca307ef8dc28a7bad5e3617bea6554ad3380a6c626ea53f809f4b7f9708
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(313235);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/11");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk61630");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");
  script_xref(name:"IAVA", value:"2024-A-0375-S");

  script_name(english:"Cisco Expressway Series Remote Code Execution Vulnerability (regreSSHion) (cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Expressway Series is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Expressway Series due to a signal handler race condition found 
    in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler is 
    called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk61630");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk61630");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/08");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:telepresence_video_communication_server");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:telepresence_video_communication_server_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_telepresence_video_communication_server_detect.nbin");
  script_require_keys("Cisco/TelePresence_VCS/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco TelePresence VCS');

var vuln_ranges = [
  {'min_ver' : '14.3', 'fix_ver' : '14.3.6'},
  {'min_ver' : '15.0', 'fix_ver' : '15.0.3'}
];

var reporting = {
  'port'           : product_info['port'],
  'severity'       : SECURITY_HOLE,
  'version'        : product_info['version'],
  'bug_id'         : 'CSCwk61630',
  'disable_caveat' : TRUE
};

cisco::check_and_report(
  product_info : product_info,
  reporting    : reporting,
  vuln_ranges  : vuln_ranges
);