Mitsubishi Electric MELSEC-F Series Null Pointer Dereference (CVE-2021-20596)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500538);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2021-20596");

  script_name(english:"Mitsubishi Electric MELSEC-F Series Null Pointer Dereference (CVE-2021-20596)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14
and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a DoS
condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected and
system reset is required for recovery.  

This plugin only works with Tenable.ot. Please visit
https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-006_en.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e12e9fa6");
  script_set_attribute(attribute:"see_also", value:"https://jvn.jp/vu/JVNVU94348759/index.html");
  script_set_attribute(attribute:"see_also", value:"https://us-cert.cisa.gov/ics/advisories/icsa-21-201-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Mitsubishi Electric Corporation recommends using the newest version of firmware possible. The fixed products and
versions are as follows:

- FX3U-ENET：Firmware Version 1.16 or later
- FX3U-ENET-L：Firmware Version 1.16 or later
- FX3U-ENET-P502：Firmware Version 1.16 or later

To minimize the risk of exploiting this vulnerability, Mitsubishi Electric Corporation recommends users take the
following mitigations:

- Use a firewall or virtual private network (VPN), etc., to prevent unauthorized access when Internet access is
required.
- Use within a LAN and block access from untrusted networks and hosts through firewalls.

Please refer to the Mitsubishi Electric advisory for further details.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-20596");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishielectric:fx3u-enet-l_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishielectric:fx3u-enet-p502_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mitsubishielectric:fx3u-enet_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Mitsubishi");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Mitsubishi');

var asset = tenable_ot::assets::get(vendor:'Mitsubishi');

var vuln_cpes = {
    "cpe:/o:mitsubishielectric:fx3u-enet-l_firmware" :
        {"versionEndIncluding" : "1.14", "family" : "MELSECFCP"},
    "cpe:/o:mitsubishielectric:fx3u-enet-p502_firmware" :
        {"versionEndIncluding" : "1.14", "family" : "MELSECFCP"},
    "cpe:/o:mitsubishielectric:fx3u-enet_firmware" :
        {"versionEndIncluding" : "1.14", "family" : "MELSECFCP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);