Korenix JetNet Cross-Site Request Forgery (CVE-2020-12502)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502679);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/11/27");

  script_cve_id("CVE-2020-12502");

  script_name(english:"Korenix JetNet Cross-Site Request Forgery (CVE-2020-12502)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP,
JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706,
JetNet 5428G, JetNet 6095, JetNet 4706 are prone to unauthenticated
device administration.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9b6c5fb");
  # http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12f313d6");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2021/Jun/0");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/de-de/advisories/vde-2020-040");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en-us/advisories/vde-2020-053");
  # https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5575502");
  # http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9b6c5fb");
  # http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12f313d6");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2021/Jun/0");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/de-de/advisories/vde-2020-040");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en-us/advisories/vde-2020-053");
  # https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5575502");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12502");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(352);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/10/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4510_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4706_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4706f_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5010_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5310_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5428g-20sfp_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5428g_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5810g_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet6095_firmware:-");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Korenix");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Korenix');

var asset = tenable_ot::assets::get(vendor:'Korenix');

var vuln_cpes = {
  "cpe:/o:korenix:jetnet5428g-20sfp_firmware:-" :
      {"versionStartIncluding": "1.0", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5810g_firmware:-" :
      {"versionStartIncluding": "1.1", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4510_firmware:-" :
      {"versionStartIncluding": "2.3b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5010_firmware:-" :
      {"versionStartIncluding": "3.0b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5310_firmware:-" :
      {"versionEndExcluding": "1.6", "versionStartIncluding": "1.5", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet6095_firmware:-" :
      {"versionStartIncluding": "2.1a", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4706_firmware:-" :
      {"versionStartIncluding": "2.1b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4706f_firmware:-" :
      {"versionStartIncluding": "2.1b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5428g_firmware:-" :
      {"versionStartIncluding": "2.1a", "family" : "JetNet"}
};


tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);