Cisco NX-OS Software CLI Bypass to Internal Service (CVE-2019-1726)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501245);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1726");

  script_name(english:"Cisco NX-OS Software CLI Bypass to Internal Service (CVE-2019-1726)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the CLI of Cisco NX-OS Software could allow an
authenticated, local attacker to access internal services that should
be restricted on an affected device, such as the NX-API. The
vulnerability is due to insufficient validation of arguments passed to
a certain CLI command. An attacker could exploit this vulnerability by
including malicious input as the argument to the affected command. A
successful exploit could allow the attacker to bypass intended
restrictions and access internal services of the device. An attacker
would need valid device credentials to exploit this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/108409");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cli-bypass
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d14497b3");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1726");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:6.2%2825%29" :
        {"versionEndExcluding" : "6.2%2825%29", "versionStartIncluding" : "5.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.3%282%29" :
        {"versionEndExcluding" : "8.3%282%29", "versionStartIncluding" : "7.3", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%283%29" :
        {"versionEndExcluding" : "7.0%283%29i7%283%29", "versionStartIncluding" : "7.0%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:6.0%282%29a8%2811%29" :
        {"versionEndExcluding" : "6.0%282%29a8%2811%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%284%29n1%281%29" :
        {"versionEndExcluding" : "7.3%284%29n1%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:6.2%2822%29" :
        {"versionEndExcluding" : "6.2%2822%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%283%29d1%281%29" :
        {"versionEndExcluding" : "7.3%283%29d1%281%29", "versionStartIncluding" : "7.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:4.0%281d%29" :
        {"versionEndExcluding" : "4.0%281d%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);