Generex UPS Adapter CS141 Improper Limitation of a Pathname to a Restricted Directory (CVE-2020-11420)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503966);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2020-11420");

  script_name(english:"Generex UPS Adapter CS141 Improper Limitation of a Pathname to a Restricted Directory (CVE-2020-11420)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker
with Admin or Engineer login credentials could exploit the
vulnerability by manipulating variables that reference files and by
doing this achieve access to files and directories outside the web
root folder. An attacker may access arbitrary files and directories
stored in the file system, but integrity of the files are not
jeopardized as attacker have read access rights only.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://library.e.abb.com/public/ee46f3ff5823400f991ebd9bd43a297e/2CMT2020-005913%20Security%20Advisory%20CS141.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?290a3fef");
# https://www.generex.de/index.php?option=com_content&task=view&id=185&Itemid=249
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dc778b65");
  script_set_attribute(attribute:"see_also", value:"https://www.generex.de/support/changelogs/cs141/page:2");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-11420");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:generex:cs141_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Generex");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Generex');

var asset = tenable_ot::assets::get(vendor:'Generex');

var vuln_cpes = {
    "cpe:/o:generex:cs141_firmware" :
        {"versionEndExcluding" : "1.90", "family" : "CS141"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);