ABB Relion 650 and 670 Series Improper Input Validation (CVE-2019-18247)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500358);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2019-18247");
  script_xref(name:"ICSA", value:"19-330-02");

  script_name(english:"ABB Relion 650 and 670 Series Improper Input Validation (CVE-2019-18247)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An attacker may use a specially crafted message to force Relion 650
series (versions 1.3.0.5 and prior) or Relion 670 series (versions
1.2.3.18, 2.0.0.11, 2.1.0.1 and prior) to reboot, which could cause a
denial of service.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.us-cert.gov/ics/advisories/icsa-19-330-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

ABB recommends that users apply the following or later versions at the earliest convenience:

- Relion 650 series version 1.3.0.6
- Relion 670 series version 1.2.3.19
- Relion 670 series version 2.0.0.12
- Relion 670 series version 2.1.0.2

Updates can be ordered by email at: [email protected]

ABB also recommends that these and other proper security practices and firewall configurations be implemented to help
protect a process control network from attacks originating outside the network:

- Process control systems are physically protected from direct access by unauthorized personnel.
- Process control systems have no direct connections to the Internet.
- Process control systems are separated from other networks by means of a firewall system that has a minimal number of
ports/services exposed.
- Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
- Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a
control system.

More information on recommended practices can be found in the ABB Cybersecurity Deployment Guidelines for each product
version.

ABB has not identified any workaround; however, firewall rules could be set to block incoming traffic to Port 7001/TCP
that originate from outside the network.

In the Relion 650 series Version 1.3, the SPA protocol over TCP/IP could be disabled if it is not in use.

For more information, see the ABB Cybersecurity Advisory 1MRG027165");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-18247");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:relion_650_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:relion_670_firmware:1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:relion_670_firmware:2");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:relion_650_firmware" :
        {"versionEndIncluding" : "1.3.0.5", "family" : "AbbRelion"},
    "cpe:/o:hitachienergy:relion_670_firmware:1" :
        {"versionEndIncluding" : "1.2.3.18", "family" : "AbbRelion"},
    "cpe:/o:hitachienergy:relion_670_firmware:2.0" :
        {"versionEndIncluding" : "2.0.0.11", "versionStartIncluding" : "2.0.0", "family" : "AbbRelion"},
    "cpe:/o:hitachienergy:relion_670_firmware:2.1" :
        {"versionEndIncluding" : "2.1.0.1", "versionStartIncluding" : "2.1.0", "family" : "AbbRelion"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);