Cisco Desk/IP/Video Phone Multiple Vulnerabilities (cisco-sa-phone-write-g3kcC5Df)

#TRUSTED 1e3deeaa73b4428ee49e75436f0e3ca96fa49d6b4e03ae3317b40508a8b87e1608f30c080d2f817710643ddcb34f1e0df87c8add54d28bf02221b1a14a88546d4e81502a1f2bc0e773e79b38e1c0b31f1722d72dbfa5bbf2e2848a2ff5c155cb031e0b0cfbabcc4876e713bfeda1e71853cff2b2d341beb16f6c999b6a17d84527e0f4d4e13b0e85ed4deb23144c01168a031ee7d39c82c9b71d76b6b90e1b6eb06738455608d5f4bd9226fe48430c3a95f739c951fcd94f6ff48aefddeba95cfafae53325ff033fa6f27a47328df3fdbf1642efdae883784c3a30902af4228f8d519f724bff0e44898b998a0f446a9d198f1337de4bc48cfae48efaa7959e5f28806610239246653b6d8fe87bd01181c8ddd3ce665b732e648c83f530f58ebb3581d5a0a18be5623c21a693e4aec1daf245c4e98d107fc68683088d5b9c22a95d212700210662093b6caddb8c113096f9522e58f6f04461dffda0999c567f2abb813e2a4728b2b11189534fe9100355985b795f27371f2388e15d1f97bdfac25222ee1a7540713058cefef427db12784672dc5204632e7797d121f8ad05ec12dfdcbaaad19976d0b8dc17c685c6f0879189ca2d468d3f18ab5242fa8a1cbf6edb19857cf0dce4c773d4833ab50e0ace5760b8e2044e9d6893dd78fcad43fc4f200e8931cb50ca2b08a5bb8807ed506632367684a505860b559730b74a5ace89
#TRUST-RSA-SHA256 73b34c4b111485fbbb85ded775a35371c424ea6395ab2c436fa14bd400fbea9a7fe392f24bb96fc0423fc502403b752ceba6b9544d720bdc9161db1776f987f1de24c6281e18f120ad768233691d2189637cce46a3d8010149f3aba40224db22625c4b9fc7f91e349e8586fbc43b44a3bb401b1a51047a4017b91ff987ffe1ac510dd80c41149b88b61fe76fd3011649298fdc5d09fcb431bf49bfefeef66601e2d0eb042a0c6357a97d88959c02e2c0f9a7bf2b57de46f21dcec5f10cd61ff8dfc75e42d42cc287f916d7f3d699a855e279fc91348dd9e02f61190fcbad01fc21ab1c3fe6ec4fed62bd80a39100e9168684babf70e124b1337aaca9f188f5bb0a658b28dd1753d3f74b8c68928860f96147b2fe5d38e744f882b9cffccfb208cb29281c30902c9f9a4d80b9d6f8ef2b1407db149bbc45aba386375814b20b2ec4236e492205936f8236bb49bf39f69af63f63950566ab9f9d9f8771965c96cf064def11c379d6bf1c52755fe6e5130153c2a16d16e0cedafd76aa891d7b45613c8987d72f0ae8ade76dcf6019e4a44a087e5c0a4dd0818c5c27263d4c4a8eb77d2aa719e27df7e3e4dd1ba81f5c1e7d2bdeb90ccd3e227bee4d9f7ac2de8e2fb080287972759f65b59b0b536195122168654d4e7e71446802371cb0dc9129d4545aeb1189dff735e7037123e4c8ec7268be308bbf2810258b2d845db12a12bc
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(264636);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/12");

  script_cve_id("CVE-2025-20335", "CVE-2025-20336");
  script_xref(name:"IAVA", value:"2025-A-0655");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn51677");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn51679");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52909");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52910");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52911");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52913");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52919");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52920");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52921");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn52922");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55709");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55710");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55712");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55714");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55725");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55726");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55727");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn55728");
  script_xref(name:"CISCO-SA", value:"cisco-sa-phone-write-g3kcC5Df");

  script_name(english:"Cisco Desk/IP/Video Phone Multiple Vulnerabilities (cisco-sa-phone-write-g3kcC5Df)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote Cisco Desk, IP or Video Phone running SIP Software is
affected by multiple vulnerabilities that could allow an unauthenticated, remote attacker to conduct arbitrary
file write and information disclosure attacks. To exploit these vulnerabilities, Web Access must be enabled on
the phone. Web Access is disabled by default.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-write-g3kcC5Df
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?335db2e6");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn51677");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn51679");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52909");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52910");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52911");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52913");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52919");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52920");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52921");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn52922");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55709");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55710");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55712");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55714");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55725");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55726");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55727");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn55728");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwn51677, CSCwn51679, CSCwn52909, CSCwn52910,
CSCwn52911, CSCwn52913, CSCwn52919, CSCwn52920, CSCwn52921, CSCwn52922, CSCwn55709, CSCwn55710, CSCwn55712, CSCwn55714,
CSCwn55725, CSCwn55726, CSCwn55727, CSCwn55728");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20336");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200, 284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/12");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/h:cisco:ip_phone");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:cisco:ip_phone");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ip_phone_sip_detect.nbin");
  script_require_keys("installed_sw/Cisco IP Phone", "Settings/ParanoidReport");
  script_require_ports("Services/sip", "Services/udp/sip");

  exit(0);
}

include('vcf_extras.inc');

# Unable to determine if web access is enabled
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var app = 'Cisco IP Phone';

var detected_on = get_kb_list('installed_sw/*/Cisco IP Phone/service/*/SIP/Banner');

var report = '';

foreach var item (keys(detected_on))
{
  var portproto = pregmatch(string:item, pattern:'installed_sw/([0-9]+)/Cisco IP Phone/service/([a-z]{3})/SIP/Banner');
  if (!empty_or_null(portproto))
  {
    var port = portproto[1];
    var proto = portproto[2];
    var app_info = vcf::cisco_ip_phone::get_app_info(app:app, port:port, proto:proto);

    var mod = app_info['model'];

    var models = {
      '7800': {'constraints': [{'fixed_version' : '14.3(1)SR2'}]},
      '8800': {'constraints': [{'fixed_version' : '14.3(1)SR2'}]},
      '8821': {'constraints': [{'fixed_version' : '11.0(6)SR7'}]},
      '8875': {'constraints': [{'fixed_version' : '3.3(1)'}]},
      '9800': {'constraints': [{'fixed_version' : '3.3(1)'}]}
    };
    report += vcf::cisco_ip_phone::check_version(app_info:app_info, constraints:models[app_info.model]['constraints']);
  }
}

if (empty_or_null(report))
  audit(AUDIT_HOST_NOT, 'affected');

security_report_v4(
  port:port,
  proto:proto,
  severity:SECURITY_WARNING,
  extra:report
);