Cisco NX-OS Exposure of Resource to Wrong Sphere (CVE-2017-12351)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502745);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2017-12351");

  script_name(english:"Cisco NX-OS Exposure of Resource to Wrong Sphere (CVE-2017-12351)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the guest shell feature of Cisco NX-OS System
Software could allow an authenticated, local attacker to read and send
packets outside the scope of the guest shell container. An attacker
would need valid administrator credentials to perform this attack. The
vulnerability is due to insufficient internal security measures in the
guest shell feature. An attacker could exploit this vulnerability by
sending or receiving packets on the device-internal network outside of
the guest shell container, aka Unauthorized Internal Interface
Access. This vulnerability affects the following products running
Cisco NX-OS System Software: Nexus 3000 Series Switches, Nexus 9000
Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line
Cards and Fabric Modules. Cisco Bug IDs: CSCvf33038.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102019");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039932");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos10
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?729f9221");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102019");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039932");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos10
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?729f9221");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12351");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(264, 668);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_3000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_9000_series_switches");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_3000_series_switches:7.0%283%29I5%281%29" :
        {"versionEndIncluding" : "7.0%283%29I5%281%29", "versionStartIncluding" : "7.0%283%29I5%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:7.0%283%29I5%282%29" :
        {"versionEndIncluding" : "7.0%283%29I5%282%29", "versionStartIncluding" : "7.0%283%29I5%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:7.0%283%29I6%281%29" :
        {"versionEndIncluding" : "7.0%283%29I6%281%29", "versionStartIncluding" : "7.0%283%29I6%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:7.0%283%29I6%282%29" :
        {"versionEndIncluding" : "7.0%283%29I6%282%29", "versionStartIncluding" : "7.0%283%29I6%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:7.0%283%29I5%281%29" :
        {"versionEndIncluding" : "7.0%283%29I5%281%29", "versionStartIncluding" : "7.0%283%29I5%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:7.0%283%29I5%282%29" :
        {"versionEndIncluding" : "7.0%283%29I5%282%29", "versionStartIncluding" : "7.0%283%29I5%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:7.0%283%29I6%281%29" :
        {"versionEndIncluding" : "7.0%283%29I6%281%29", "versionStartIncluding" : "7.0%283%29I6%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:7.0%283%29I6%282%29" :
        {"versionEndIncluding" : "7.0%283%29I6%282%29", "versionStartIncluding" : "7.0%283%29I6%282%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);