Konica Bizhub Multifunction Printers Server-Side Request Forgery (CVE-2024-51980)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505041);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/04");

  script_cve_id("CVE-2024-51980");

  script_name(english:"Konica Bizhub Multifunction Printers Server-Side Request Forgery (CVE-2024-51980)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An unauthenticated attacker may perform a limited server side request forgery (SSRF), 
forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. 
This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. 
The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. 
This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) 
is exposed across a network segment.");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-51980");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2024-51980");
  # https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6c7d4950");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-51980");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(918);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_5020i_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_5000i_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_4020i_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_4000i_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_3080mf_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:konicaminolta:bizhub_3000mf_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Konica");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Konica');

var asset = tenable_ot::assets::get(vendor:'Konica');

var vuln_cpes = {
    "cpe:/o:konicaminolta:bizhub_5020i_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "U2406280431"},
    "cpe:/o:konicaminolta:bizhub_5000i_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "1.32"},
    "cpe:/o:konicaminolta:bizhub_4020i_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "U2406280431"},
    "cpe:/o:konicaminolta:bizhub_4000i_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "1.28"},
    "cpe:/o:konicaminolta:bizhub_3080mf_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "N2403271808"},
    "cpe:/o:konicaminolta:bizhub_3000mf_firmware" :
        {"family" : "Bizhub", "versionEndIncluding" : "M2403271743"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);