Mitsubishi Electric GOT and Tension Controller (CVE-2021-20589)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501762);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/08");

  script_cve_id("CVE-2021-20589");

  script_name(english:"Mitsubishi Electric GOT and Tension Controller (CVE-2021-20589)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Buffer access with incorrect length value vulnerability in GOT2000
series GT27 model communication driver versions 01.19.000 through
01.38.000, GT25 model communication driver versions 01.19.000 through
01.38.000, GT23 model communication driver versions 01.19.000 through
01.38.000 and GT21 model communication driver versions 01.21.000
through 01.39.000, GOT SIMPLE series GS21 model communication driver
versions 01.21.000 through 01.39.000, GT SoftGOT2000 versions 1.170C
through 1.250L and Tension Controller LE7-40GU-L Screen package data
for MODBUS/TCP V1.00 allows a remote unauthenticated attacker to stop
the communication function of the products via specially crafted
packets.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-002_en.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eba71079");
  script_set_attribute(attribute:"see_also", value:"https://jvn.jp/vu/JVNVU99895108/index.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-21-131-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Mitsubishi Electric has created the following versions to address this vulnerability:

- GOT2000 series: GT27 model, GT25 model, and GT23 model: update to 01.39.000 or later.
- GOT2000 series: GT21 model: update to 01.40.000 or later.
- GOT SIMPLE series GS21 model: update to 01.40.000 or later.
- GT SoftGOT2000: update to 1.255R or later.

- LE7-40GU-L Screen package data for MODBUS/TCP: update to v1.01 or later.

Please refer to the Mitsubishi Electric website for detailed update procedures.

Mitsubishi Electric recommends the following mitigations until users can update to safer versions:

- When connecting the product to the Internet, use a firewall or virtual private network (VPN) to prevent unauthorized
access.
- Use it within the LAN and make it inaccessible from untrusted networks and hosts.
- Install antivirus software on a computer that can access the product.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-20589");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/05/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gs21_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gt21_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gt23_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gt25_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gt27_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishi:gt_softgot2000_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Mitsubishi");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Mitsubishi');

var asset = tenable_ot::assets::get(vendor:'Mitsubishi');

var vuln_cpes = {
    "cpe:/o:mitsubishi:gt27_firmware" :
        {"versionEndIncluding" : "01.38.000", "versionStartIncluding" : "01.19.000", "family" : "Mitsubishi"},
    "cpe:/o:mitsubishi:gt25_firmware" :
        {"versionEndIncluding" : "01.38.000", "versionStartIncluding" : "01.19.000", "family" : "Mitsubishi"},
    "cpe:/o:mitsubishi:gt23_firmware" :
        {"versionEndIncluding" : "01.38.000", "versionStartIncluding" : "01.19.000", "family" : "Mitsubishi"},
    "cpe:/o:mitsubishi:gt21_firmware" :
        {"versionEndIncluding" : "01.39.000", "versionStartIncluding" : "01.21.000", "family" : "Mitsubishi"},
    "cpe:/o:mitsubishi:gs21_firmware" :
        {"versionEndIncluding" : "01.39.000", "versionStartIncluding" : "01.21.000", "family" : "Mitsubishi"},
    "cpe:/o:mitsubishi:gt_softgot2000_firmware" :
        {"versionEndIncluding" : "1.250l", "versionStartIncluding" : "1.170c", "family" : "Mitsubishi"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);