ABB M2M Gateway HTTP Request Smuggling in embedded Bind (CVE-2021-25220)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503228);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/27");

  script_cve_id("CVE-2021-25220");
  script_xref(name:"ICSA", value:"25-105-08");

  script_name(english:"ABB M2M Gateway HTTP Request Smuggling in embedded Bind (CVE-2021-25220)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND
Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 ->
9.16.26-S1 Versions of BIND 9 earlier than those shown - back to
9.1.0, including Supported Preview Editions - are also believed to be
affected but have not been tested as they are EOL. The cache could
become poisoned with incorrect records leading to queries being made
to the wrong servers, which might also result in false information
being returned to clients.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08");
  # https://search.abb.com/library/Download.aspx?DocumentID=2NGA002579&LanguageCode=en&DocumentPartId=pdf&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?310ae51a");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf");
  script_set_attribute(attribute:"see_also", value:"https://kb.isc.org/v1/docs/cve-2021-25220");
  # https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?900259f2");
  # https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?afa0a462");
  # https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad520e27");
  # https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7c130272");
  # https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f03c3a4b");
  script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/202210-25");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20220408-0001/");
  # https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7b77cba6");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-25220");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(444);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/03/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:arm600_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:sw_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:abb:arm600_firmware:-" :
        {"versionEndIncluding": "5.0.3", "versionStartIncluding": "4.1.2", "family" : "AbbM2M"},
    "cpe:/o:abb:sw_firmware:-" :
        {"versionEndIncluding": "5.0.3", "versionStartIncluding": "5.0.1", "family" : "AbbM2M"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);