AVTECH Room Alert Cleartext Storage of Sensitive Information (CVE-2024-33470)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505322);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/20");

  script_cve_id("CVE-2024-33470");

  script_name(english:"AVTECH Room Alert Cleartext Storage of Sensitive Information (CVE-2024-33470)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"When an administrator authenticates with the device and 
browses the settings pages, the SMTP password is loaded 
from the device and presented in the DOM in plaintext. 
When settings are saved, the SMTP credentials are sent back 
to the device in plain text. This allows an actor with 
administrative access to the device to obtain the SMTP 
credentials previously stored in the device's settings.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://avtech.com/articles/27443/security-advisory-smtp-password-disclosure-in-dom/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eee13101");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-33470");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(312);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/05/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_3e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_4e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_12e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_32e_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/AVTECH");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/AVTECH');

var asset = tenable_ot::assets::get(vendor:'AVTECH');

var vuln_cpes = {
    "cpe:/o:avtech:room_alert_3e_firmware" :
        {"versionEndIncluding" : "2.4.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_4e_firmware" :
        {"versionEndIncluding" : "4.4.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_12e_firmware" :
        {"versionEndIncluding" : "3.3.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_32e_firmware" :
        {"versionEndIncluding" : "3.3.1", "family" : "RoomAlert"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);