Rockwell Automation PowerMonitor 1000 Unprotected Alternate Channel (CVE-2024-12371)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502808);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/12/20");

  script_cve_id("CVE-2024-12371");
  script_xref(name:"ICSA", value:"24-352-03");

  script_name(english:"Rockwell Automation PowerMonitor 1000 Unprotected Alternate Channel (CVE-2024-12371)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A device takeover vulnerability exists in the affected product. 
This vulnerability allows configuration of a new Policyholder user 
without any authentication via API. Policyholder user is the most 
privileged user that can perform edit operations, creating admin 
users and performing factory reset.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?019d53f7");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03");
  script_set_attribute(attribute:"solution", value:
"Rockwell Automation has corrected these problems in firmware 
revision 4.020 and recommends users upgrade to the latest version available");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12371");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(420);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/12/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-bc3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-bc3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-ts3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-ts3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr1a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr2a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em1a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em2a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr1a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr2a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em1a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em2a-ent");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwell:1408-bc3a-485" :
        {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-bc3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-ts3a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-ts3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em3a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr1a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr2a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em1a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em2a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr1a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr2a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em1a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em2a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);