Rockwell Automation MicroLogix Improper Authentication (CVE-2017-12092)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500093);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2017-12092");

  script_name(english:"Rockwell Automation MicroLogix Improper Authentication (CVE-2017-12092)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400
Series B FRN 21.2 and before. A specially crafted packet can cause a file write resulting in a new program being written
to the memory module. An attacker can send an unauthenticated packet to trigger this vulnerability.  

This plugin only
works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0444
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a26b3f7c");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-18-095-01");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN1015.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9d68ca89");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has recommended that users employ the following mitigation strategies where applicable:

- Users using affected versions of MicroLogix 1100 and MicroLogix 1400 Series A are urged to contact their local
distributor or Sales Office in order to upgrade their devices to a newer product line.
- Set keyswitch to Hard Run to block any unauthorized changes
- For MicroLogix 1400 Series only, Apply FRN 21.002 or later

Rockwell Automation has provided more specific mitigations that can be found in their customer notification (KB1072942)
located at:

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1072942# (login required)");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12092");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micrologix_1400_b_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:micrologix_1400_b_firmware" :
        {"versionEndIncluding" : "21.2", "family" : "MicroLogix1400"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);