AVTECH Room Alert Cleartext Transmission of Sensitive Information (CVE-2024-33471)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505324);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/20");

  script_cve_id("CVE-2024-33471");

  script_name(english:"AVTECH Room Alert Cleartext Transmission of Sensitive Information (CVE-2024-33471)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An individual with administrative access can change the mail 
server host within the device. An attacker who has obtained 
administrative access can update the mail server to an attacker 
controller IP. When the device attempts to authenticate 
to the mail server, it will pass the previously configured 
credentials in plaintext to the attacker's IP.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://avtech.com/articles/27472/security-advisory-smtp-credentials-pass-back/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bb657cd7");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-33471");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(319);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/05/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_3e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_4e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_12e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_32e_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_3s_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_12s_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:avtech:room_alert_32s_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/AVTECH");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/AVTECH');

var asset = tenable_ot::assets::get(vendor:'AVTECH');

var vuln_cpes = {
    "cpe:/o:avtech:room_alert_3e_firmware" :
        {"versionEndIncluding" : "2.4.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_4e_firmware" :
        {"versionEndIncluding" : "4.4.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_12e_firmware" :
        {"versionEndIncluding" : "3.3.0", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_32e_firmware" :
        {"versionEndIncluding" : "3.3.1", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_3s_firmware" :
        {"versionEndIncluding" : "1.10.3", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_12s_firmware" :
        {"versionEndIncluding" : "1.10.3", "family" : "RoomAlert"},
    "cpe:/o:avtech:room_alert_32s_firmware" :
        {"versionEndIncluding" : "1.10.3", "family" : "RoomAlert"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);