Rockwell Automation Allen-Bradley Stratix 5950 Improper Certificate Validation (CVE-2018-0227)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506145);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-0227");

  script_name(english:"Rockwell Automation Allen-Bradley Stratix 5950 Improper Certificate Validation (CVE-2018-0227)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Secure Sockets Layer (SSL) Virtual Private
Network (VPN) Client Certificate Authentication feature for Cisco
Adaptive Security Appliance (ASA) could allow an unauthenticated,
remote attacker to establish an SSL VPN connection and bypass certain
SSL certificate verification steps. The vulnerability is due to
incorrect verification of the SSL Client Certificate. An attacker
could exploit this vulnerability by connecting to the ASA VPN without
a proper private key and certificate pair. A successful exploit could
allow the attacker to establish an SSL VPN connection to the ASA when
the connection should have been rejected. This vulnerability affects
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense
(FTD) Software that is running on the following Cisco products: 3000
Series Industrial Security Appliances (ISA), ASA 5500 Series Adaptive
Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA
Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600
Series Routers, Adaptive Security Virtual Appliances (ASAv), Firepower
4110 Security Appliances, Firepower 9300 ASA Security Modules. Cisco
Bug IDs: CSCvg40155.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3022fd51");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/104018");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040723");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends
that users using affected devices apply the following risk mitigation strategies:

- CVE-2018-0228 — The ASA and FTD configuration commands—set connection per-client-embryonic-max (TCP) and set
connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol [SCTP])—can be configured to limit the
number of connection requests allowed. Using these configuration parameters can reduce the number of connections and
greatly reduce the impact of the DoS attack.
- CVE-2018-0227 — No workarounds available
- CVE-2018-0231 — No workarounds available
- CVE-2018-0240 — No workarounds available
- CVE-2018-0296 — Cisco has released Snort Rule 46897

For additional information please see the Rockwell Automation security notification at (login required):
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073860

Additionally the Cisco advisories can be found at the following links:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0227");
  script_cwe_id(295);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4.4" :
        {"versionEndIncluding" : "9.4.4.13", "versionStartIncluding" : "9.4.4", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.5.3.7" :
        {"versionEndIncluding" : "9.5.3.9", "versionStartIncluding" : "9.5.3.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.6.2.9" :
        {"versionEndIncluding" : "9.6.2.21", "versionStartIncluding" : "9.6.2.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.6.3" :
        {"versionEndIncluding" : "9.6.3.17", "versionStartIncluding" : "9.6.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.1" :
        {"versionEndIncluding" : "9.4.3.1", "versionStartIncluding" : "9.4.3.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.4.3.2" :
        {"versionEndIncluding" : "9.4.3.2", "versionStartIncluding" : "9.4.3.2", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.7" :
        {"versionEndIncluding" : "9.5.2.7", "versionStartIncluding" : "9.5.2.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.5.2.8" :
        {"versionEndIncluding" : "9.5.2.8", "versionStartIncluding" : "9.5.2.8", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);