Schneider Electric Modicon M221 Permissions, Privileges, and Access Controls (CVE-2018-7791)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500849);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2018-7791");

  script_name(english:"Schneider Electric Modicon M221 Permissions, Privileges, and Access Controls (CVE-2018-7791)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A Permissions, Privileges, and Access Control vulnerability exists in
Schneider Electric's Modicon M221 product (all references, all
versions prior to firmware V1.6.2.0). The vulnerability allows
unauthorized users to overwrite the original password with their
password. If an attacker exploits this vulnerability and overwrite the
password, the attacker can upload the original program from the PLC.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/105182");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-18-240-01");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-235-01
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8a96d9c");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

A fix for these vulnerabilities is implemented in Modicon M221 Firmware v1.6.2.0, delivered within SoMachine Basic v1.6
SP2, which is available for download below, or by using Schneider Electric Software Update tool:

https://www.schneider-electric.com/en/download/document/SoMachineBasicV1.6SP2/

As a temporary mitigation, Modicon M221 users should take the following measures:

- Set up a firewall blocking all remote/external access to Port 502.
- Within the Modicon M221 application, users must disable all unused protocols, especially programming protocol, as
described in section “Configuring Ethernet Network” of SoMachine Basic online help. This will prevent remote programming
of the M221 PLC.

Schneider Electric’s security notice SEVD-2018-235-01 is available at the following location:

https://www.schneider-electric.com/en/download/document/SEVD-2018-235-01/");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-7791");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/08/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/01");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m221_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:modicon_m221_series_firmware" :
        {"versionEndExcluding" : "1.6.2.0", "family" : "ModiconM221"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);