Phoenix Contact Classic Line Industrial Controllers Missing Authentication For Critical Function (CVE-2019-9201)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500775);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2019-9201");

  script_name(english:"Phoenix Contact Classic Line Industrial Controllers Missing Authentication For Critical Function (CVE-2019-9201)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple Phoenix Contact devices allow remote attackers to establish
TCP sessions to port 1962 and obtain sensitive information or make
changes, as demonstrated by using the Create Backup feature to
traverse all directories.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://medium.com/@SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a72318f1");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/en/advisories/VDE-2019-015/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-172-05");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Phoenix Contact has provided the following mitigations and workarounds:

- Phoenix Contact classic line controllers are designed and developed for use in closed industrial networks. The control
and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact recommends using the
devices exclusively in closed networks, protected by a suitable firewall.
- If the use of an affected controller in protected zones is not suitable, OT communication protocols should be disabled
either by using the CPU services via console or web-based management according to the controller type.
- Information for which controllers and from which firmware version communication protocols can be disabled are
described in Phoenix Contact’s application note for classic line controllers, or the manual to the respective
controller, which is available for download at the Phoenix Contact website.

For detailed information on Phoenix Contact’s recommendations for measures to protect network-capable devices, please
refer to their application note for classic line controllers:

Measures to protect devices based on classic control technology

Controller supporting CPU services or WBM for disabling communication protocols:

- ILC 1x0: All variants, firmware: no fix
- ILC 1x1: All variants, firmware: 4.42
- ILC 1x1 GMS/GPRS: Article number2700977, firmware: 4.42
- ILC 3xx: All variants, firmware 3.98
- AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)
- AXC 1050XC: Article number 2701295, firmware 3.01, 5.00 (WBM)
- AXC 3050: Article number 2700989, firmware 5.60, 6.30 (WBM)
- RFC 480S PN 4TX: Article number 2404577, firmware 6.10
- RFC 470 PN 3TX: Article number 291660, firmware 4.20
- RFC 470S PN 3TX: Article number 2916794, firmware 4.20
- RFC 460R PN 3TX: Article number 2700784, firmware 5.00
- RFC 460R PN 3TX-S: Article number 1096407, firmware 5.30
- RFC 430 ETH-IB: Article number 2730190, no fix
- RFC 450 ETH-IB: Article number 2730200, no fix
- PC WORX SRT: Article number 2701680, no fix
- PC WORX RT BASIC: Article number 2700291, no fix
- FC 350 PCI ETH: Article number 2730844, no fix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9201");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/01/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:axc_1050_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_131_eth%2fxc_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_131_eth_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_151_eth%2fxc_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_151_eth_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_171_eth_2tx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_191_eth_2tx_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:phoenixcontact:ilc_191_me%2fan_firmware:-");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/PhoenixContact");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/PhoenixContact');

var asset = tenable_ot::assets::get(vendor:'PhoenixContact');

var vuln_cpes = {
    "cpe:/o:phoenixcontact:ilc_131_eth_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_131_eth%2fxc_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_151_eth_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_151_eth%2fxc_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_171_eth_2tx_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_191_eth_2tx_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:ilc_191_me%2fan_firmware:-" :
        {"family" : "ILC100"},
    "cpe:/o:phoenixcontact:axc_1050_firmware:-" :
        {"family" : "AXC1000"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);