Rockwell Automation Micro800 and MicroLogix 1400 Channel Accessible By Non-Endpoint (CVE-2021-32926)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500456);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2021-32926");

  script_name(english:"Rockwell Automation Micro800 and MicroLogix 1400 Channel Accessible By Non-Endpoint (CVE-2021-32926)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the
message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no
longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing
a denial-of-service condition  

This plugin only works with Tenable.ot. Please visit
https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://us-cert.cisa.gov/ics/advisories/icsa-21-145-02");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN1566.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9dfd6ded");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell recommends confirming that setting and updating the password for the controller is done within a trusted
network environment.

If this vulnerability is successfully exploited, the password can be reset by performing a firmware flash on the
controller. Firmware flashing will put the controller into the default state and the user program and data will be lost.

A comprehensive defense-in-depth strategy can reduce the risk of this vulnerability. To leverage the vulnerability, an
unauthorized user would require access to the same network as the controller. Users should confirm they are employing
proper networking segmentation and security controls.

Users can refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices for
deploying network segmentation and broader defense-in-depth strategies. Users can also refer to the Rockwell Automation
System Security Design Guidelines on how to use Rockwell Automation products to improve the security of their industrial
automation systems.

For more information see Rockwell Automation Security Advisory (login required).");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-32926");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(300);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/06/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro810_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro820_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro830_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro850_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro870_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micrologix_1400_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:micro810_firmware" :
        {"family" : "Micro810"},
    "cpe:/o:rockwellautomation:micro820_firmware" :
        {"family" : "Micro820"},
    "cpe:/o:rockwellautomation:micro830_firmware" :
        {"family" : "Micro830"},
    "cpe:/o:rockwellautomation:micro850_firmware" :
        {"family" : "Micro850"},
    "cpe:/o:rockwellautomation:micro870_firmware" :
        {"family" : "Micro870"},
    "cpe:/o:rockwellautomation:micrologix_1400_firmware" :
        {"versionStartIncluding" : "21.0", "family" : "MicroLogix1400"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);