Korenix JetNet Authenticated Command Injection (CVE-2020-12503)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502681);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/11/27");

  script_cve_id("CVE-2020-12503");

  script_name(english:"Korenix JetNet Authenticated Command Injection (CVE-2020-12503)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP,
JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706,
JetNet 5428G, JetNet 6095, JetNet 4706 are prone to multiple
authenticated command injections.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9b6c5fb");
  # http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12f313d6");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2021/Jun/0");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/de-de/advisories/vde-2020-040");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en-us/advisories/vde-2020-053");
  # https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5575502");
  # http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9b6c5fb");
  # http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12f313d6");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2021/Jun/0");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/de-de/advisories/vde-2020-040");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en-us/advisories/vde-2020-053");
  # https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5575502");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12503");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/10/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4510_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4706_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet4706f_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5010_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5310_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5428g-20sfp_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5428g_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet5810g_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:korenix:jetnet6095_firmware:-");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Korenix");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Korenix');

var asset = tenable_ot::assets::get(vendor:'Korenix');

var vuln_cpes = {
  "cpe:/o:korenix:jetnet5428g-20sfp_firmware:-" :
      {"versionStartIncluding": "1.0", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5810g_firmware:-" :
      {"versionStartIncluding": "1.1", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4510_firmware:-" :
      {"versionStartIncluding": "2.3b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5010_firmware:-" :
      {"versionStartIncluding": "3.0b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5310_firmware:-" :
      {"versionEndExcluding": "1.6", "versionStartIncluding": "1.5", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet6095_firmware:-" :
      {"versionStartIncluding": "2.1a", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4706_firmware:-" :
      {"versionStartIncluding": "2.1b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet4706f_firmware:-" :
      {"versionStartIncluding": "2.1b", "family" : "JetNet"},
  "cpe:/o:korenix:jetnet5428g_firmware:-" :
      {"versionStartIncluding": "2.1a", "family" : "JetNet"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);