Cisco NX-OS Missing Authorization (CVE-2020-3394)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502694);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2020-3394");

  script_name(english:"Cisco NX-OS Missing Authorization (CVE-2020-3394)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Enable Secret feature of Cisco Nexus 3000
Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-
OS mode could allow an authenticated, local attacker to issue the
enable command and get full administrative privileges. To exploit this
vulnerability, the attacker would need to have valid credentials for
the affected device. The vulnerability is due to a logic error in the
implementation of the enable command. An attacker could exploit this
vulnerability by logging in to the device and issuing the enable
command. A successful exploit could allow the attacker to gain full
administrative privileges without using the enable password. Note: The
Enable Secret feature is disabled by default.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3n9k-priv-escal-3QhXJBC
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c634fbd");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3n9k-priv-escal-3QhXJBC
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c634fbd");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3394");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(285, 862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/08/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_3000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_9000_series_switches");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%281%29" :
        {"versionEndIncluding" : "9.2%281%29", "versionStartIncluding" : "9.2%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.2%281%29" :
        {"versionEndIncluding" : "9.2%281%29", "versionStartIncluding" : "9.2%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%282%29" :
        {"versionEndIncluding" : "9.2%282%29", "versionStartIncluding" : "9.2%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.2%282%29" :
        {"versionEndIncluding" : "9.2%282%29", "versionStartIncluding" : "9.2%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%282t%29" :
        {"versionEndIncluding" : "9.2%282t%29", "versionStartIncluding" : "9.2%282t%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%283%29" :
        {"versionEndIncluding" : "9.2%283%29", "versionStartIncluding" : "9.2%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.2%283%29" :
        {"versionEndIncluding" : "9.2%283%29", "versionStartIncluding" : "9.2%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%283y%29" :
        {"versionEndIncluding" : "9.2%283y%29", "versionStartIncluding" : "9.2%283y%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.2%283y%29" :
        {"versionEndIncluding" : "9.2%283y%29", "versionStartIncluding" : "9.2%283y%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%281%29" :
        {"versionEndIncluding" : "9.3%281%29", "versionStartIncluding" : "9.3%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%281%29" :
        {"versionEndIncluding" : "9.3%281%29", "versionStartIncluding" : "9.3%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%284%29" :
        {"versionEndIncluding" : "9.2%284%29", "versionStartIncluding" : "9.2%284%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.2%284%29" :
        {"versionEndIncluding" : "9.2%284%29", "versionStartIncluding" : "9.2%284%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.2%282v%29" :
        {"versionEndIncluding" : "9.2%282v%29", "versionStartIncluding" : "9.2%282v%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%282%29" :
        {"versionEndIncluding" : "9.3%282%29", "versionStartIncluding" : "9.3%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%282%29" :
        {"versionEndIncluding" : "9.3%282%29", "versionStartIncluding" : "9.3%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%283%29" :
        {"versionEndIncluding" : "9.3%283%29", "versionStartIncluding" : "9.3%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%283%29" :
        {"versionEndIncluding" : "9.3%283%29", "versionStartIncluding" : "9.3%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%281z%29" :
        {"versionEndIncluding" : "9.3%281z%29", "versionStartIncluding" : "9.3%281z%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);