NETGEAR WNR2000 RCE (PSV-2016-0261)

##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(172498);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/03/14");

  script_cve_id("CVE-2017-6862");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/06/22");

  script_name(english:"NETGEAR WNR2000 RCE (PSV-2016-0261)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices 
before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses 
a parameter in the administration webapp. This vulnerability can only be exploited when an attacker 
can access the internal network or when remote management is enabled on the router. Remote management 
is turned off by default, users can turn on remote management through advanced settings.

Note that Nessus has not tested for these issues but has instead relied only on the application's 
self-reported version number.");
  # https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac3ee11a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the NETGEAR WNR2000 version mentioned in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-6862");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:netgear:wnr2000v3_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:netgear:wnr2000v4_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:netgear:wnr2000v5_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:netgear:wnr2000_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("netgear_wireless_n_router_web_detect.nbin");
  script_require_keys("installed_sw/NETGEAR Wireless N Router");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::get_app_info(app:'NETGEAR Wireless N Router');

var model = app_info['Model'];
if (empty_or_null(model) && report_paranoia < 2)
  audit(AUDIT_POTENTIAL_VULN, 'NETGEAR Wireless N Router', app_info.version);

var constraints = [];

if (model =~ "^WNR2000v3")
  constraints = [{'fixed_version' : '1.1.2.14' }];
else if (model =~ "^WNR2000v4")
  constraints = [{'fixed_version' : '1.0.0.66' }];
else if (model =~ "^WNR2000v5")
  constraints = [{'fixed_version' : '1.0.0.42' }];
else if (!empty_or_null(model))
  audit(AUDIT_DEVICE_NOT_VULN, model);
else # Paranoid, no model case with widest possible range
  constraints = [{'fixed_version' : '1.1.2.14' }];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);