Schneider Electric Modicon Arbitrary Code Execution (CVE-2013-0664)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500191);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2013-0664");
  script_xref(name:"ICSA", value:"13-077-01");

  script_name(english:"Schneider Electric Modicon Arbitrary Code Execution (CVE-2013-0664)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium
TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary
code, by embedding these messages in SOAP HTTP POST requests.  

This plugin only works with Tenable.ot. Please visit
https://www.tenable.com/products/tenable-ot for more information.");
  # http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0ec12ec6");
  # http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c3596b1c");
# script_set_attribute(attribute:"see_also", value:"http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-0664");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/04/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/04/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:schneider-electric:modicon_quantum_plc:140nwm10000");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:schneider-electric:modicon_quantum_plc:140noe77111");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:schneider-electric:modicon_m340:bmxnoe0110x");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:schneider-electric:modicon_premium:tsxety5103");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/h:schneider-electric:modicon_quantum_plc:140nwm10000" :
        {"family" : "QuantumUnityCP"},
    "cpe:/h:schneider-electric:modicon_quantum_plc:140noe77111" :
        {"family" : "QuantumUnityCP"},
    "cpe:/h:schneider-electric:modicon_m340:bmxnoe0110x" :
        {"family" : "ModiconM340M580CP"},
    "cpe:/h:schneider-electric:modicon_premium:tsxety5103" :
        {"family" : "PremiumCP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);