Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500880);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2022-45788");

  script_name(english:"Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A CWE-754: Improper Check for Unusual or Exceptional Conditions
vulnerability exists that could cause arbitrary code execution, denial
of service and loss of confidentiality & integrity when a malicious
project file is loaded onto the controller. Affected Products:
EcoStruxure Control Expert (All Versions), EcoStruxure Process
Expert (Versions prior to V2020), Modicon M340 CPU - part numbers
BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and
BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S
and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor -
171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy
Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions)

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b7c7db8");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-23-201-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Schneider Electric released the following remediations for users to implement: 

- EcoStruxure Process Expert: Version V2021 available for download and is not impacted by this vulnerability, as the
affected component has been removed from this version.
- EcoStruxure Control Expert: Software V15.3 includes a fix for this vulnerability and is available for download.
- Modicon M580 (part numbers BMEP* and BMEH*, excluding M580 CPU Safety): Firmware SV4.10 includes a fix for this
vulnerability and is available for download.
- Modicon Momentum Unity M1E Processor (part numbers 171CBU*): Firmware VS2.6 includes a fix for this vulnerability and
is available for download.
- Modicon M340 CPU (part numbers BMXP34*): Firmware SV3.51 includes a fix for this vulnerability and is available for
download.
- Modicon MC80 CPU (part numbers BMKC80*): Firmware SV1.90 includes a fix for this vulnerability and is available for
download.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric
recommends using backups and evaluating the impact of these patches in a “testing and development environment” or on an
offline infrastructure.

Users should contact Schneider Electric for assistance in removing a patch.

Users should apply the best practices for network hardening as documented in the product user guide and the Schneider
Electric Recommended Cybersecurity Best Practices.

For more information, see Schneider Electric’s security advisory SEVD-2023-010-05.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-45788");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(754);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/01/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/01/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp341000_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342000_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp3420102_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342010_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342020_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342020h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp3420302_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp3420302h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342030_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxp342030h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh582040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh582040c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh582040s_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh584040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh584040c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh584040s_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh586040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh586040c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmeh586040s_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep581020_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep581020h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep582020_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep582020h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep582040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep582040h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep582040s_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep583020_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep583040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep584020_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep584040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep584040s_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep585040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep585040c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep586040_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m580_bmep586040c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_mc80_bmkc8020301_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_mc80_bmkc8020310_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_mc80_bmkc8030311_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_momentum_171cbu78090_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_momentum_171cbu98090_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_momentum_171cbu98091_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_1634m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_2634m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_2834m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_454m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_4634m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_554m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_5634m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_premium_tsxp57_6634m_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_quantum_140cpu65150_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_quantum_140cpu65150c_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_quantum_140cpu65160_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_quantum_140cpu65160c_firmware:-");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:modicon_m340_bmxp341000_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342000_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342010_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp3420102_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342020_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342020h_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342030_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp3420302_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp3420302h_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxp342030h_firmware:-" :
        {"versionEndExcluding" : "3.51", "family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh582040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh582040c_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh582040s_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh584040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh584040c_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh584040s_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh586040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh586040c_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmeh586040s_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep581020_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep581020h_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep582020_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep582020h_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep582040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep582040h_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep582040s_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep583020_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep583040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep584020_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep584040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep584040s_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep585040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep585040c_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep586040_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_m580_bmep586040c_firmware:-" :
        {"versionEndExcluding" : "4.10", "family" : "ModiconM580"},
    "cpe:/o:schneider-electric:modicon_momentum_171cbu78090_firmware:-" :
        {"versionEndExcluding" : "2.6", "family" : "MomentumUnity"},
    "cpe:/o:schneider-electric:modicon_momentum_171cbu98090_firmware:-" :
        {"versionEndExcluding" : "2.6", "family" : "MomentumUnity"},
    "cpe:/o:schneider-electric:modicon_momentum_171cbu98091_firmware:-" :
        {"versionEndExcluding" : "2.6", "family" : "MomentumUnity"},
    "cpe:/o:schneider-electric:modicon_mc80_bmkc8020301_firmware:-" :
        {"versionEndExcluding" : "1.90", "family" : "ModiconMC80"},
    "cpe:/o:schneider-electric:modicon_mc80_bmkc8020310_firmware:-" :
        {"versionEndExcluding" : "1.90", "family" : "ModiconMC80"},
    "cpe:/o:schneider-electric:modicon_mc80_bmkc8030311_firmware:-" :
        {"versionEndExcluding" : "1.90", "family" : "ModiconMC80"},
    "cpe:/o:schneider-electric:modicon_quantum_140cpu65150_firmware:-" :
        {"family" : "QuantumUnity"},
    "cpe:/o:schneider-electric:modicon_quantum_140cpu65150c_firmware:-" :
        {"family" : "QuantumUnity"},
    "cpe:/o:schneider-electric:modicon_quantum_140cpu65160_firmware:-" :
        {"family" : "QuantumUnity"},
    "cpe:/o:schneider-electric:modicon_quantum_140cpu65160c_firmware:-" :
        {"family" : "QuantumUnity"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_1634m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_2634m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_2834m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_454m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_4634m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_554m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_5634m_firmware:-" :
        {"family" : "Premium"},
    "cpe:/o:schneider-electric:modicon_premium_tsxp57_6634m_firmware:-" :
        {"family" : "Premium"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);