ABB RTU500 Series, AFS series and M2M Gateway Type Confusion in embedded OpenSSL (CVE-2023-0286)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501746);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/13");

  script_cve_id("CVE-2023-0286");
  script_xref(name:"ICSA", value:"23-143-02");
  script_xref(name:"ICSA", value:"24-205-02");
  script_xref(name:"ICSA", value:"25-105-08");

  script_name(english:"ABB RTU500 Series, AFS series and M2M Gateway Type Confusion in embedded OpenSSL (CVE-2023-0286)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability exists in the OpenSSL that affects
the RTU500 Series product versions listed below.

RTU500 series CMU Firmware versions
12.0.1 – 12.0.15
12.2.1 – 12.2.12
12.4.1 – 12.4.12
12.6.1 – 12.6.9
12.7.1 – 12.7.6
13.2.1 – 13.2.6
13.3.1 – 13.3.3
13.4.2

M2M Gateway ARM600: Versions 4.1.2 up to and including 5.0.3
M2M Gateway SW: Versions 5.0.1 up to and including 5.0.3


There is a type confusion vulnerability relating to X.400 address
processing inside an X.509 GeneralName. X.400 addresses were parsed as
an ASN1_STRING but the public structure definition for GENERAL_NAME
incorrectly specified the type of the x400Address field as ASN1_TYPE.
This field is subsequently interpreted by the OpenSSL function
GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL
checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker
to pass arbitrary pointers to a memcmp call, enabling them to read
memory contents or enact a denial of service. In most cases, the
attack requires the attacker to provide both the certificate chain and
CRL, neither of which need to have a valid signature. If the attacker
only controls one of these inputs, the other input must already
contain an X.400 address as a CRL distribution point, which is
uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for
retrieving CRLs over a network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-02");
  # https://publisher.hitachienergy.com/preview?DocumentID=8DBD000150&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ca25a8b");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08");
  # https://search.abb.com/library/Download.aspx?DocumentID=2NGA002579&LanguageCode=en&DocumentPartId=pdf&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?310ae51a");
  script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/news/secadv/20230207.txt");
  # https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b2f61775");
  # https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0713627");
  # https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?257bff83");
  # https://publisher.hitachienergy.com/preview?DocumentId=8DBD000164&languageCode=en&Preview=true
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?499e790a");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-205-02");
  script_set_attribute(attribute:"solution", value:
"Hitachi Energy has released the following mitigations/fixes:

- AFS650: Update to AFS 650 firmware version 9.1.10
- AFS660-C, AFS665-B, AFS670-V2: Update to AFS 66x firmware version 7.1.08
- AFS670/675/677, AFR677: Update to AFS/AFR 67x firmware version 9.1.10

In addition, recommended security practices and firewall configurations can help protect a process control network from
attacks that originate from outside the network. Such practices include that process control systems are physically
protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated
from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to
be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or
receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they
are connected to a control system.

For more information, see Hitachi Energy's Cybersecurity Advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-0286");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(843);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/02/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/02/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/09/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu500_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:arm600_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:sw_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs650");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs660-c");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs665-b");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs670-v2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs670");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs675");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afs677");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:afr677");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
  "cpe:/o:hitachienergy:rtu500_firmware:12.0" :
      {"versionEndIncluding" : "12.0.15", "versionStartIncluding" : "12.0.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:12.2" :
      {"versionEndIncluding" : "12.2.12", "versionStartIncluding" : "12.2.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:12.4" :
      {"versionEndIncluding" : "12.4.12", "versionStartIncluding" : "12.4.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:12.6" :
      {"versionEndIncluding" : "12.6.9", "versionStartIncluding" : "12.6.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:12.7" :
      {"versionEndIncluding" : "12.7.6", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:13.2" :
      {"versionEndIncluding" : "13.2.6", "versionStartIncluding" : "13.2.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:13.3" :
      {"versionEndIncluding" : "13.3.4", "versionStartIncluding" : "13.3.1", "family" : "AbbRTU500"},
  "cpe:/o:hitachienergy:rtu500_firmware:13.4.1" :
      {"versionEndIncluding" : "13.4.2", "versionStartIncluding" : "13.4.2", "family" : "AbbRTU500"},
  "cpe:/o:abb:arm600_firmware:-" :
      {"versionEndIncluding": "5.0.3", "versionStartIncluding": "4.1.2", "family" : "AbbM2M"},
  "cpe:/o:abb:sw_firmware:-" :
      {"versionEndIncluding": "5.0.3", "versionStartIncluding": "5.0.1", "family" : "AbbM2M"},
  "cpe:/o:abb:afs650":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
  "cpe:/o:abb:afs660-c":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
  "cpe:/o:abb:afs665-b":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
  "cpe:/o:abb:afs670-v2":
      {"versionEndIncluding" : "7.1.05", "family" : "AbbAFS"},
  "cpe:/o:abb:afs670":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
  "cpe:/o:abb:afs675":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
  "cpe:/o:abb:afs677":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"},
  "cpe:/o:abb:afr677":
      {"versionEndIncluding" : "9.1.08", "family" : "AbbAFS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);