Geo Vision EoL Devices Improper Neutralization of Special Elements used in an OS Command (CVE-2024-6047)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503225);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/13");

  script_cve_id("CVE-2024-6047");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/05/28");

  script_name(english:"Geo Vision EoL Devices Improper Neutralization of Special Elements used in an OS Command (CVE-2024-6047)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Certain EOL GeoVision devices fail to properly filter user input for
the specific functionality. Unauthenticated remote attackers can
exploit this vulnerability to inject and execute arbitrary system
commands on the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html");
  script_set_attribute(attribute:"see_also", value:"https://www.twcert.org.tw/newepaper/cp-151-7883-f5635-3.html");
  # https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?27ab061e");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6047");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs03_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs04a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs04h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs14_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:geovision:gv-vs2410_firmware:-");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/GeoVision");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/GeoVision');

var asset = tenable_ot::assets::get(vendor:'GeoVision');

var vuln_cpes = {
    "cpe:/o:geovision:gv-vs14_firmware:-" :
        {"family" : "GeoVisionVideoServers"},
    "cpe:/o:geovision:gv-vs03_firmware:-" :
        {"family" : "GeoVisionVideoServers"},
    "cpe:/o:geovision:gv-vs04a_firmware:-" :
        {"family" : "GeoVisionVideoServers"},
    "cpe:/o:geovision:gv-vs04h_firmware:-" :
        {"family" : "GeoVisionVideoServers"},
    "cpe:/o:geovision:gv-vs2410_firmware:-" :
        {"family" : "GeoVisionVideoServers"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);