B&R Automation X20EDS410 Write-what-where Condition (CVE-2026-43284)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505890);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2026-43284");
  script_xref(name:"ICSA", value:"26-174-06");

  script_name(english:"B&R Automation X20EDS410 Write-what-where Condition (CVE-2026-43284)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Linux kernel version shipped with the affected B&R product (X20EDS410)
is affected by a vulnerability. A flaw in the kernel's xfrm ESP input path that decrypts in place over shared skb frags.

Successful local exploitation of this vulnerability could allow an
authenticated attacker with low privileges to escalate privileges to root on
the affected system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f099aa0");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

B&R recommends that users update affected products to the latest available version and apply their defense in depth for
B&R products strategy. For details on this issue, please refer to the corresponding ABB PSIRT security advisory
(SA26P010).");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43284");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(123);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:br-automation:x20eds410");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/BRAutomation");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/BRAutomation');

var asset = tenable_ot::assets::get(vendor:'BRAutomation');

var vuln_cpes = {
    "cpe:/h:br-automation:x20eds410" :
        {"family" : "X20System"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);