B&R Automation X20EDS410 Incorrect Resource Transfer Between Spheres (CVE-2026-31431)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505894);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2026-31431");
  script_xref(name:"ICSA", value:"26-174-06");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/05/15");

  script_name(english:"B&R Automation X20EDS410 Incorrect Resource Transfer Between Spheres (CVE-2026-31431)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Linux kernel version shipped with the affected B&R product (X20EDS410)
is affected by a vulnerability. A flaw in the kernel's crypto algif_aead in-place operation handling.

Successful local exploitation of this vulnerability could allow an
authenticated attacker with low privileges to escalate privileges to root on
the affected system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f099aa0");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

B&R recommends that users update affected products to the latest available version and apply their defense in depth for
B&R products strategy. For details on this issue, please refer to the corresponding ABB PSIRT security advisory
(SA26P010).");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31431");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Copy Fail AF_ALG + authencesn Page-Cache Write');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_cwe_id(669);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:br-automation:x20eds410");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/BRAutomation");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/BRAutomation');

var asset = tenable_ot::assets::get(vendor:'BRAutomation');

var vuln_cpes = {
    "cpe:/h:br-automation:x20eds410" :
        {"family" : "X20System"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);