Hitachi Energy RTU500 series BCI Improper Input Validation (CVE-2021-35533)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500949);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2021-35533");

  script_name(english:"Hitachi Energy RTU500 series BCI Improper Input Validation (CVE-2021-35533)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper Input Validation vulnerability in the APDU parser in the
Bidirectional Communication Interface (BCI) IEC 60870-5-104 function
of Hitachi Energy RTU500 series allows an attacker to cause the
receiving RTU500 CMU of which the BCI is enabled to reboot when
receiving a specially crafted message. By default, BCI IEC 60870-5-104
function is disabled (not configured). This issue affects: Hitachi
Energy RTU500 series CMU Firmware version 12.0.* (all versions); CMU
Firmware version 12.2.* (all versions); CMU Firmware version 12.4.*
(all versions).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://search.abb.com/library/Download.aspx?DocumentID=8DBD000063&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?181c9f84");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-21-336-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Hitachi Energy recommends the following:

- Disable BCI IEC 60870-5-104 function by configuration if it is not used. Note: By default, the BCI IEC 60870-5-104 is
disabled.
- Update to RTU500 series CMU Firmware Version 12.6.5.0 or later (e.g., RTU500 CMU Firmware Version 12.7.* or CMU
Firmware Version 13.2.* or later).

Please see Hitachi Energy advisory 8DBD000063 for additional mitigation and update information.

Hitachi Energy recommends the following security practices and firewall configurations to help protect process control
networks from attacks that originate from outside the network:

- Physically protect process control systems from direct access by unauthorized personnel.
- Do not directly connect to the Internet.
- Separated from other networks by means of a firewall system with a minimal number of ports exposed.
- Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
- Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a
control system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-35533");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/11/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/11/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:rtu500_firmware:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:rtu500_firmware:12.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:rtu500_firmware:12.4");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:abb:rtu500_firmware:12.0" :
        {"versionEndExcluding" : "12.1", "versionStartIncluding" : "12.0", "family" : "AbbRTU500"},
    "cpe:/o:abb:rtu500_firmware:12.2" :
        {"versionEndExcluding" : "12.3", "versionStartIncluding" : "12.2", "family" : "AbbRTU500"},
    "cpe:/o:abb:rtu500_firmware:12.4" :
        {"versionEndExcluding" : "12.6.5.0", "versionStartIncluding" : "12.4", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);