ABB RTU500 series Cross-site Scripting (CVE-2023-5768)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501846);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/12/21");

  script_cve_id("CVE-2023-5768");

  script_name(english:"ABB RTU500 series Cross-site Scripting (CVE-2023-5768)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability exists in the HCI IEC 60870-5-104 that affects the
RTU500 series product versions listed below. Incomplete or wrong
received APDU frame layout may cause blocking on link layer. Error
reason was an endless blocking when reading incoming frames on link
layer with wrong length information of APDU or delayed reception of
data octets. Only communication link of affected HCI IEC 60870-5-104
is blocked. If attack sequence stops the communication to the
previously attacked link gets normal again.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e97b4773");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-5768");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/12/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:12");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu520_firmware:12" :
        {"versionEndIncluding" : "12.0.14", "versionStartIncluding" : "12.0.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:12.2" :
        {"versionEndIncluding" : "12.2.11", "versionStartIncluding" : "12.2.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:12.4" :
        {"versionEndIncluding" : "12.4.11", "versionStartIncluding" : "12.4.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:12.6" :
        {"versionEndIncluding" : "12.6.9", "versionStartIncluding" : "12.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:12.7" :
        {"versionEndIncluding" : "12.7.6", "versionStartIncluding" : "12.7.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.2" :
        {"versionEndIncluding" : "13.2.6", "versionStartIncluding" : "13.2.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.4" :
        {"versionEndIncluding" : "13.4.3", "versionStartIncluding" : "13.4.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);