Hitachi ABB AFS Double Free (CVE-2022-4450)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503959);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2022-4450");
  script_xref(name:"ICSA", value:"24-205-02");

  script_name(english:"Hitachi ABB AFS Double Free (CVE-2022-4450)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
but the public structure definition for GENERAL_NAME incorrectly specified
the type of the x400Address field as ASN1_TYPE.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentId=8DBD000164&languageCode=en&Preview=true
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?499e790a");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-205-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Hitachi Energy has released the following mitigations/fixes:

- AFS650: Update to AFS 650 firmware version 9.1.10
- AFS660-C, AFS665-B, AFS670-V2: Update to AFS 66x firmware version 7.1.08
- AFS670/675/677, AFR677: Update to AFS/AFR 67x firmware version 9.1.10

In addition, recommended security practices and firewall configurations can help protect a process control network from
attacks that originate from outside the network. Such practices include that process control systems are physically
protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated
from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to
be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or
receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they
are connected to a control system.

For more information, see Hitachi Energy's Cybersecurity Advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-4450");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(415);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs650");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs660-c");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs665-b");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs670-v2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs670");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs675");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs677");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afr677");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:abb:afs650":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
    "cpe:/o:abb:afs660-c":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
    "cpe:/o:abb:afs665-b":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
    "cpe:/o:abb:afs670-v2":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
    "cpe:/o:abb:afs670":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
    "cpe:/o:abb:afs675":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
    "cpe:/o:abb:afs677":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
    "cpe:/o:abb:afr677":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);