Rockwell Automation PowerMonitor 1000 Heap-Based Buffer Overflow (CVE-2024-12372)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502806);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/12/20");

  script_cve_id("CVE-2024-12372");
  script_xref(name:"ICSA", value:"24-352-03");

  script_name(english:"Rockwell Automation PowerMonitor 1000 Heap-Based Buffer Overflow (CVE-2024-12372)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A denial-of-service and possible remote code execution vulnerability 
exists in the affected product. The vulnerability results in corruption 
of the heap memory which may compromise the integrity of the system, 
potentially allowing for remote code execution or a denial-of-service attack.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?019d53f7");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03");
  script_set_attribute(attribute:"solution", value:
"Rockwell Automation has corrected these problems in firmware 
revision 4.020 and recommends users upgrade to the latest version available");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12372");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(122);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/12/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-bc3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-bc3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-ts3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-ts3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em3a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em3a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr1a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr2a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em1a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em2a-485");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr1a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-tr2a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em1a-ent");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwell:1408-em2a-ent");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwell:1408-bc3a-485" :
        {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-bc3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-ts3a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-ts3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em3a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em3a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr1a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr2a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em1a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em2a-485" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr1a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-tr2a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em1a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"},
    "cpe:/o:rockwell:1408-em2a-ent" :
       {"versionEndExcluding" : "4.020", "family" : "PowerMonitor1000"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);