Moxa NPort W2150A/W2250A Series Stack-based Buffer Overflow (CVE-2024-1220)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503047);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/03/10");

  script_cve_id("CVE-2024-1220");

  script_name(english:"Moxa NPort W2150A/W2250A Series Stack-based Buffer Overflow (CVE-2024-1220)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A stack-based buffer overflow in the built-in web server in Moxa NPort
W2150A/W2250A Series firmware version 2.3 and prior allows a remote
attacker to exploit the vulnerability by sending crafted payload to
the web service. Successful exploitation of the vulnerability could
result in denial of service.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.moxa.com/en/support/product-support/security-advisory/mpsa-238975-nport-w2150a-w2250a-series-web-server-stack-based-buffer-overflow-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74833156");
  # https://www.moxa.com/en/support/product-support/security-advisory/mpsa-238975-nport-w2150a-w2250a-series-web-server-stack-based-buffer-overflow-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74833156");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-1220");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(121, 787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:nport_w2150a-t_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:nport_w2150a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:nport_w2250a-t_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:moxa:nport_w2250a_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Moxa");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Moxa');

var asset = tenable_ot::assets::get(vendor:'Moxa');

var vuln_cpes = {
    "cpe:/o:moxa:nport_w2150a_firmware" :
        {"versionEndIncluding" : "2.3", "family" : "NPort"},
    "cpe:/o:moxa:nport_w2250a_firmware" :
        {"versionEndIncluding" : "2.3", "family" : "NPort"},
    "cpe:/o:moxa:nport_w2150a-t_firmware" :
        {"versionEndIncluding" : "2.3", "family" : "NPort"},
    "cpe:/o:moxa:nport_w2250a-t_firmware" :
        {"versionEndIncluding" : "2.3", "family" : "NPort"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);