GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16246)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503350);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/03");

  script_cve_id("CVE-2020-16246");
  script_xref(name:"ICSA", value:"20-266-02");

  script_name(english:"GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16246)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The affected Reason S20 Ethernet Switch is vulnerable to cross-site
scripting (XSS), which may allow attackers to trick users into
following a link or navigating to a page that posts a malicious
JavaScript statement to the vulnerable site, causing the malicious
JavaScript to be rendered by the site and executed by the victim
client.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

GE recommends that S20 users upgrade to firmware Version 07A06 or higher to fix this vulnerability. Instructions on how
to upgrade the firmware and verify its installation are available in the product user’s manual. Upgrading can be done by
downloading the upgrade file directly from the GE website.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-16246");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:ge:s2020_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:ge:s2024_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/GE");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/GE');

var asset = tenable_ot::assets::get(vendor:'GE');

var vuln_cpes = {
    "cpe:/o:ge:s2020_firmware" :
        {"versionEndExcluding" : "07a06", "family" : "ReasonS20"},
    "cpe:/o:ge:s2024_firmware" :
        {"versionEndExcluding" : "07a06", "family" : "ReasonS20"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);