Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380 Improper Input Validation (CVE-2024-7515)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502372);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/03/10");

  script_cve_id("CVE-2024-7515");
  script_xref(name:"ICSA", value:"24-226-10");

  script_name(english:"Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380 Improper Input Validation (CVE-2024-7515)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A denial-of-service vulnerability exists in the affected products.
A malformed PTP management packet can cause a major nonrecoverable
fault in the controller.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201686.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c9a53448");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-10");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends the following actions:

- Update products to v36.011, v35.013, v34.014 or later.
- Restrict communication to CIP object 103 (0x67)
- For information on how to mitigate Security Risks on industrial automation control systems, Rockwell Automation
encourages users to implement their suggested security best practices to minimize the risk of the vulnerability.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-7515");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5380_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5480_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:controllogix_5580_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:guardlogix_5580_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:compactlogix_5380_firmware:34" :
        {"versionEndExcluding" : "34.014", "versionStartIncluding" : "28.011", "family" : "CompactLogix5380"},
    "cpe:/o:rockwellautomation:compactlogix_5380_firmware:35" :
        {"versionEndExcluding" : "35.013", "versionStartIncluding" : "35", "family" : "CompactLogix5380"},
    "cpe:/o:rockwellautomation:compactlogix_5380_firmware:36" :
        {"versionEndExcluding" : "36.011", "versionStartIncluding" : "36", "family" : "CompactLogix5380"},
    "cpe:/o:rockwellautomation:compactlogix_5480_firmware:34" :
        {"versionEndExcluding" : "34.014", "versionStartIncluding" : "28.011", "family" : "CompactLogix5480"},
    "cpe:/o:rockwellautomation:compactlogix_5480_firmware:35" :
        {"versionEndExcluding" : "35.013", "versionStartIncluding" : "35", "family" : "CompactLogix5480"},
    "cpe:/o:rockwellautomation:compactlogix_5480_firmware:36" :
        {"versionEndExcluding" : "36.011", "versionStartIncluding" : "36", "family" : "CompactLogix5480"},
    "cpe:/o:rockwellautomation:controllogix_5580_firmware:34" :
        {"versionEndExcluding" : "34.014", "versionStartIncluding" : "28.011", "family" : "ControlLogix5580"},
    "cpe:/o:rockwellautomation:controllogix_5580_firmware:35" :
        {"versionEndExcluding" : "35.013", "versionStartIncluding" : "35", "family" : "ControlLogix5580"},
    "cpe:/o:rockwellautomation:controllogix_5580_firmware:36" :
        {"versionEndExcluding" : "36.011", "versionStartIncluding" : "36", "family" : "ControlLogix5580"},
    "cpe:/o:rockwellautomation:guardlogix_5580_firmware:34" :
        {"versionEndExcluding" : "34.014", "versionStartIncluding" : "31.011", "family" : "GuardLogix5580"},
    "cpe:/o:rockwellautomation:guardlogix_5580_firmware:35" :
        {"versionEndExcluding" : "35.013", "versionStartIncluding" : "35", "family" : "GuardLogix5580"},
    "cpe:/o:rockwellautomation:guardlogix_5580_firmware:36" :
        {"versionEndExcluding" : "36.011", "versionStartIncluding" : "36", "family" : "GuardLogix5580"},
    "cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware:34" :
        {"versionEndExcluding" : "34.014", "versionStartIncluding" : "31.011", "family" : "GuardLogix5380"},
    "cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware:35" :
        {"versionEndExcluding" : "35.013", "versionStartIncluding" : "35", "family" : "GuardLogix5380"},
    "cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware:36" :
        {"versionEndExcluding" : "36.011", "versionStartIncluding" : "36", "family" : "GuardLogix5380"},
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);