Cisco IP Phones Improper Neutralization of Input During Web Page Generation (CVE-2011-2545)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503157);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/04/11");

  script_cve_id("CVE-2011-2545");

  script_name(english:"Cisco IP Phones Improper Neutralization of Input During Web Page Generation (CVE-2011-2545)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Cross-site scripting (XSS) vulnerability in the SIP implementation on
the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102
before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote
attackers to inject arbitrary web script or HTML via the FROM field of
an INVITE message, aka Bug IDs CSCtr27277, CSCtr27256, CSCtr27274, and
CSCtr14715.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewAlert.x?alertId=26037");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-2545");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/06/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/11");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_501g_8-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_502g_1-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_504g_4-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_508g_8-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_509g_12-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_512g_1-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_514g_4-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_525g2_5-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:spa_525g_5-line_ip_phone");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:spa_500_series_ip_phone_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:spa_500_series_ip_phone_firmware" :
        {"versionEndIncluding" : "7.4.8", "family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_501g_8-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_502g_1-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_504g_4-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_508g_8-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_509g_12-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_512g_1-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_514g_4-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_525g_5-line_ip_phone" :
        {"family" : "CiscoIPPhones"},
    "cpe:/h:cisco:spa_525g2_5-line_ip_phone" :
        {"family" : "CiscoIPPhones"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);