Siemens SCALANCE X-200RNA Switch Devices Improper Authentication (CVE-2016-1908)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503105);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/03/13");

  script_cve_id("CVE-2016-1908");
  script_xref(name:"ICSA", value:"22-349-21");

  script_name(english:"Siemens SCALANCE X-200RNA Switch Devices Improper Authentication (CVE-2016-1908)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The client in OpenSSH before 7.2 mishandles failed cookie generation
for untrusted X11 forwarding and relies on the local X11 server for
access-control decisions, which allows remote X11 clients to trigger a
fallback and obtain trusted X11 forwarding privileges by leveraging
configuration issues on this X11 server, as demonstrated by lack of
the SECURITY extension on this X11 server.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109814809/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-21");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1908");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/12/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/12/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/03/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_%28hsr%29_firmware:3.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_%28prp%29_firmware:3.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_eec_%28hsr%29_firmware:3.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_eec_%28prp%29_firmware:3.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_eec_%28prp%2fhsr%29_firmware:3.2.7");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_x204rna_%28hsr%29_firmware:3.2.7" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ['6GK5204-0BA00-2MB2']},
    "cpe:/o:siemens:scalance_x204rna_%28prp%29_firmware:3.2.7" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ['6GK5204-0BA00-2KB2']},
    "cpe:/o:siemens:scalance_x204rna_eec_%28hsr%29_firmware:3.2.7" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ['6GK5204-0BS00-2NA3']},
    "cpe:/o:siemens:scalance_x204rna_eec_%28prp%29_firmware:3.2.7" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ['6GK5204-0BS00-3LA3']},
    "cpe:/o:siemens:scalance_x204rna_eec_%28prp%2fhsr%29_firmware:3.2.7" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ['6GK5204-0BS00-3PA3']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);