Beckhoff TwinCAT Installation Directory Incorrect Default Permissions (CVE-2020-12510)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500434);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/12");

  script_cve_id("CVE-2020-12510");

  script_name(english:"Beckhoff TwinCAT Installation Directory Incorrect Default Permissions (CVE-2020-12510)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory
does not exist it and further subdirectories are created with permissions which allow every local user to modify the
content. The default installation registers TcSysUI.exe for automatic execution upon log in of a user. If a less
privileged user has a local account he or she can replace TcSysUI.exe. It will be executed automatically by another user
during login. This is also true for users with administrative access. Consequently, a less privileged user can trick a
higher privileged user into executing code he or she modified this way. By default Beckhoff's IPCs are shipped with
TwinCAT software installed this way and with just a single local user configured. Thus the vulnerability exists if
further less privileged users have been added.  

This plugin only works with Tenable.ot. Please visit
https://www.tenable.com/products/tenable-ot for more information.");
  # https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2020-003.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f7b3268c");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en-us/advisories/vde-2020-037");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12510");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(276);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/11/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/11/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:beckhoff:twincat_extended_automation_runtime:3.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Beckhoff");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Beckhoff');

var asset = tenable_ot::assets::get(vendor:'Beckhoff');

var vuln_cpes = {
    "cpe:/a:beckhoff:twincat_extended_automation_runtime:3.1" :
        {"versionEndIncluding" : "3.1", "versionStartIncluding" : "3.1", "family" : "BeckhoffCSeries"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);