Advantech ADAM-6000 Use of Default Password (CVE-2008-5848)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505341);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/01");

  script_cve_id("CVE-2008-5848");

  script_name(english:"Advantech ADAM-6000 Use of Default Password (CVE-2008-5848)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Advantech ADAM-6000 module has 00000000 as its default password,
which makes it easier for remote attackers to obtain access through an
HTTP session, and (1) monitor or (2) control the module's Modbus/TCP
I/O activity.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://ruxcon.org.au/files/2008/SIFT-Ruxcon2008-SCADA-Hacking-Modbus-Enabled-Devices.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?63659f1c");
  # http://support.advantech.com.tw/support/DownloadSRDetail.aspx?SR_ID=1-95WMW
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d3fc4d28");
  script_set_attribute(attribute:"see_also", value:"http://www.ruxcon.org.au/presentations.shtml#13");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2008-5848");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1393);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/01/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/01/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6015");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6017");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6018");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6022");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6024");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6050");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6050w");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6051");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6051w");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6052");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6060");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6060w");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6066");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:advantech:adam-6501");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Advantech");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Advantech');

var asset = tenable_ot::assets::get(vendor:'Advantech');

var vuln_cpes = {
    "cpe:/h:advantech:adam-6015" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6017" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6018" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6022" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6024" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6050" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6050w" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6051" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6051w" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6052" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6060" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6060w" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6066" :
        {"family" : "ADAM-6000"},
    "cpe:/h:advantech:adam-6501" :
        {"family" : "ADAM-6000"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);