Dahua Security Cameras Stack-based Buffer Overflow (CVE-2019-9676)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502327);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/07/30");

  script_cve_id("CVE-2019-9676");

  script_name(english:"Dahua Security Cameras Stack-based Buffer Overflow (CVE-2019-9676)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Buffer overflow vulnerability found in some Dahua IP Camera devices
IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The
vulnerability exits in the function of redirection display for serial
port printing information, which can not be used by product basic
functions. After an attacker logs in locally, this vulnerability can
be exploited to cause device restart or arbitrary code execution.
Dahua has identified the corresponding security problems in the static
code auditing process, so it has gradually deleted this function,
which is no longer available in the newer devices and softwares. Dahua
has released versions of the affected products to fix the
vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.dahuasecurity.com/aboutUs/trustedCenter/details/512");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9676");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(121);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:ipc-hfw1xxx_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:ipc-hfw2xxx_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dahuasecurity:ipc-hdw1xxx_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/DahuaSecurity");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/DahuaSecurity');

var asset = tenable_ot::assets::get(vendor:'DahuaSecurity');

var vuln_cpes = {
  "cpe:/o:dahuasecurity:ipc-hfw1xxx_firmware" :
    {"versionEndExcluding" : "2018-11-30", "family" : "DahuaSecurity"},
  "cpe:/o:dahuasecurity:ipc-hfw1xxx_firmware" :
    {"versionEndExcluding" : "2018-11-30", "family" : "DahuaSecurity"},
  "cpe:/o:dahuasecurity:ipc-hfw1xxx_firmware" :
    {"versionEndExcluding" : "2018-11-30", "family" : "DahuaSecurity"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);