ABB CP635 HMI Lack of encryption or authenticity checks against firmware binary files (CVE-2019-7229)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500945);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/20");

  script_cve_id("CVE-2019-7229");

  script_name(english:"ABB CP635 HMI Lack of encryption or authenticity checks against firmware binary files (CVE-2019-7229)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The ABB CP635 HMI uses two different transmission methods to upgrade
its firmware and its software components: Utilization of USB/SD Card
to flash the device and Remote provisioning process via ABB Panel
Builder 600 over FTP. Neither of these transmission methods
implements any form of encryption or authenticity checks against the
new firmware HMI software binary files.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.darkmatter.ae/xen1thlabs/abb-hmi-absence-of-signature-verification-vulnerability-xl-19-005/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?414ede7d");
  # https://search.abb.com/library/Download.aspx?DocumentID=3ADR010376&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7b4a770");
  # https://search.abb.com/library/Download.aspx?DocumentID=3ADR010402&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ef4a0c16");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2019/Jun/34");
  # http://packetstormsecurity.com/files/153387/ABB-HMI-Missing-Signature-Verification.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c268e98d");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-7229");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(494);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp620-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp620_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp630-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp630_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635-b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:abb:cp620_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp620-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp630_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp630-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635-b_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);