Lucene search

K
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.TENABLE_OT_ROCKWELL_CVE-2023-2262.NASL
HistorySep 22, 2023 - 12:00 a.m.

Rockwell ControlLogix 1756 Stack-based Buffer Overflow (CVE-2023-2262)

2023-09-2200:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
6
rockwell controllogix
buffer overflow
cve-2023-2262
remote code execution
cip request
tenable.ot

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

49.6%

A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501683);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/30");

  script_cve_id("CVE-2023-2262");

  script_name(english:"Rockwell ControlLogix 1756 Stack-based Buffer Overflow (CVE-2023-2262)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A buffer overflow vulnerability exists in the Rockwell Automation
select 1756-EN* communication devices. If exploited, a threat actor
could potentially leverage this vulnerability to perform a remote code
execution. To exploit this vulnerability, a threat actor would have to
send a maliciously crafted CIP request to device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140786
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?64ad97d0");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN1649%20.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0da5224f");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-2262");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/09/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/09/22");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2f_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2fk_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2fk_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2fk_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2t_series_d_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tk_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tk_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tk_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tk_series_d_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tp_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tpk_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tpxt_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trk_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trk_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trk_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trxt_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trxt_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2trxt_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2txt_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2txt_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2txt_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2txt_series_d_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3tr_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3tr_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3trk_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en3trk_series_b_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:1756-en2t_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_c_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2t_series_d_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tk_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tk_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tk_series_c_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tk_series_d_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2txt_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2txt_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2txt_series_c_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2txt_series_d_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tp_series_a_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tpk_series_a_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trk_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trk_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trk_series_c_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trxt_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trxt_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2trxt_series_c_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2f_series_c_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2fk_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2fk_series_b_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2fk_series_c_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3tr_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3tr_series_b_firmware" :
        {"versionEndIncluding" : "11.003", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3trk_series_a_firmware" :
        {"versionEndIncluding" : "5.028", "versionStartIncluding" : "5.008", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en3trk_series_b_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tpxt_series_a_firmware" :
        {"versionEndIncluding" : "11.002", "family" : "ControlLogix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);
VendorProductVersionCPE
rockwellautomation1756-en2f_series_a_firmwarecpe:/o:rockwellautomation:1756-en2f_series_a_firmware
rockwellautomation1756-en2f_series_b_firmwarecpe:/o:rockwellautomation:1756-en2f_series_b_firmware
rockwellautomation1756-en2f_series_c_firmwarecpe:/o:rockwellautomation:1756-en2f_series_c_firmware
rockwellautomation1756-en2fk_series_a_firmwarecpe:/o:rockwellautomation:1756-en2fk_series_a_firmware
rockwellautomation1756-en2fk_series_b_firmwarecpe:/o:rockwellautomation:1756-en2fk_series_b_firmware
rockwellautomation1756-en2fk_series_c_firmwarecpe:/o:rockwellautomation:1756-en2fk_series_c_firmware
rockwellautomation1756-en2t_series_a_firmwarecpe:/o:rockwellautomation:1756-en2t_series_a_firmware
rockwellautomation1756-en2t_series_b_firmwarecpe:/o:rockwellautomation:1756-en2t_series_b_firmware
rockwellautomation1756-en2t_series_c_firmwarecpe:/o:rockwellautomation:1756-en2t_series_c_firmware
rockwellautomation1756-en2t_series_d_firmwarecpe:/o:rockwellautomation:1756-en2t_series_d_firmware
Rows per page:
1-10 of 341

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

49.6%

Related for TENABLE_OT_ROCKWELL_CVE-2023-2262.NASL