Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix Improper Input Validation (CVE-2017-9312)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500168);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2017-9312");
  script_xref(name:"ICSA", value:"18-172-02");

  script_name(english:"Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix Improper Input Validation (CVE-2017-9312)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improperly implemented option-field processing in the TCP/IP stack on
  Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial
  of service. When a crafted TCP packet is received, the device reboots
  immediately.
  
  This plugin only works with Tenable.ot.
  Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/104528");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-172-02");
# https://www.rockwellautomation.com/en-us/support/advisory.PN1025.html
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14eb9d23");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends users with affected controllers apply firmware revision FRN (31.011 or later) to the
affected products. The download can be obtained at the following location:

https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112

Users who are unable to update are directed to employ the following general security guidelines:

- Block all traffic to Ethernet/IP or other CIP protocol-based devices from outside the Manufacturing Zone by blocking
or restricting access to Port 2222/TCP and UDP and Port 44818/TCP and UDP using proper network infrastructure controls,
such as firewalls, UTM devices, or other security appliances. For more information on TCP/UDP ports used by Rockwell
Automation Products, see Knowledgebase Article ID 898270 available at:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/898270/page/1 (login required).
- Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the
Internet.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may
have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as
secure as the connected devices.

When possible, users are recommended to apply the firmware revision in conjunction with the general security guidelines
to employ multiple strategies simultaneously.

For more information on this vulnerability and more detailed mitigation instructions, please access an account in order
to view Rockwell Automation’s advisory at the following location:

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073708 (login required).");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9312");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l16er-bb1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l18er-bb1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l18erm-bb1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l19er-bb1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l24er-qb1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l24er-qbfc1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l27er-qbfc1b");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l30er");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l30er-nse");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l30erm");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l33er");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l33erm");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l36erm");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769-l37ermo");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l30erms");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l33erms");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l36erms");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l37erms");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l38erms");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l33ermos");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_1769-l36ermos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
  "cpe:/h:rockwellautomation:compactlogix_1769-l16er-bb1b:28": 
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l16er-bb1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l18er-bb1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l18er-bb1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l18erm-bb1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l18erm-bb1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l19er-bb1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l19er-bb1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l24er-qb1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l24er-qb1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l24er-qbfc1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l24er-qbfc1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l27er-qbfc1b:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l27er-qbfc1b:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30er:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30er:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30er-nse:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30er-nse:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30erm:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l30erm:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l33er:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l33er:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l33erm:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l33erm:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l36erm:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l36erm:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l37ermo:28":
      {"versionEndExcluding" : "28.015", "family": "CompactLogix5370"},
  "cpe:/h:rockwellautomation:compactlogix_1769-l37ermo:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "CompactLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l30erms:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l30erms:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l33erms:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l33erms:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l36erms:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l36erms:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l37erms:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l37erms:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l38erms:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l38erms:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l33ermos:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l33ermos:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l36ermos:28":
      {"versionEndExcluding" : "28.015", "family": "GuardLogix5370"},
  "cpe:/h:rockwellautomation:guardlogix_1769-l36ermos:30":
      {"versionEndIncluding" : "30.014", "versionStartExcluding" : "28.015", "family" : "GuardLogix5370"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);