Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules Missing Authentication For Critical Function (CVE-2018-17924)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500154);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2018-17924");
  script_xref(name:"ICSA", value:"18-310-02");

  script_name(english:"Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules Missing Authentication For Critical Function (CVE-2018-17924)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote
threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP
configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected
device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system
as the system traffic is still attempting to communicate with the device via the overwritten IP address.  

This plugin
only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/106132");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends users of affected products update to an available firmware revision that addresses the
associated risk. Users who are unable to update their firmware are directed towards additional risk mitigation
strategies provided herein and are encouraged to combine these with the general security guidelines to employ multiple
strategies simultaneously, when possible.

Rockwell Automation suggests the following actions for affected versions:

- MicroLogix 1400 Controllers 1766-Lxxx, Series A, no direct mitigation provided. See additional mitigating
recommendations below for suggested actions.
- For MicroLogix 1400 Controllers 1766-Lxxx, Series B or C, apply FRN 21.004 and later. Once the new FRN is applied, use
the LCD Display to put the controller in RUN mode to prevent configuration changes. See p. 115 of the MicroLogix 1400
Programmable Controllers User Manual (1766-UM001M-EN-P) for details (available at the following location):

https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1766-um001_-en-p.pdf

The download for FRN 21.004 can be found at the following location:

https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=1766-L&crumb=112");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-17924");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/12/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micrologix_1400_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-enbt_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-eweb_series_a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-eweb_series_b_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_b_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_b_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_d_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3tr_series_a_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3tr_series_b_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:micrologix_1400_firmware:-" :
        {"family" : "MicroLogix1400"},
    "cpe:/o:rockwellautomation:1756-enbt_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-eweb_series_a_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-eweb_series_b_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_a_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_b_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_c_firmware" :
        {"versionEndIncluding" : "10.10", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_a_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_b_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_c_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_d_firmware" :
        {"versionEndIncluding" : "10.10", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware" :
        {"versionEndIncluding" : "10.10", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3tr_series_a_firmware:-" :
        {"family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3tr_series_b_firmware" :
        {"versionEndIncluding" : "10.10", "family" : "ControlLogix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);