Siemens SIPROTEC Information Disclosure (CVE-2016-4785)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500090);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/16");

  script_cve_id("CVE-2016-4785");

  script_name(english:"Siemens SIPROTEC Information Disclosure (CVE-2016-4785)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01;
Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100
Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100
Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port
80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if
network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC
Compact devices.  

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for
more information.");
  # https://cert-portal.siemens.com/productcert/pdf/ssa-547990.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?490f0300");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-16-140-02");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/99471");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/90773");
  # https://cert-portal.siemens.com/productcert/pdf/ssa-323211.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8b06cf13");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens provides firmware update V4.27 for EN100 module included in SIPROTEC 4 and SIPROTEC Compact to fix the
vulnerabilities. The firmware updates can be found at the following locations on the Siemens website:

http://www.siemens.com/downloads/siprotec-4

http://www.siemens.com/downloads/siprotec-compact

For SIPROTEC Compact 7SJ80 with Ethernet Service Interface on Port A, Siemens provides firmware update V4.76. The
firmware update can be found at the following location on the Siemens website:

http://www.siemens.com/downloads/siprotec-compact

An attacker must have network access to the affected devices. For remaining affected products, Siemens recommends to
protect network access with appropriate mechanisms (e.g., firewalls, segmentation, VPN). It is advised to configure the
environment according to Siemens operational guidelines in order to run the devices in a protected IT environment.
Siemens provides guidance at the following location for operating the devices only within trusted networks:

http://www.siemens.com/gridsecurity

For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security
Advisory SSA-547990 at the following location:

http://www.siemens.com/cert/advisories");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4785");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/05/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_compact_7sj80_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_compact_7rw80_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_compact_7sj81_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_compact_7sk81_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:siprotec_compact_7sj80_firmware" :
        {"versionEndIncluding" : "4.75", "family" : "Siprotec"},
    "cpe:/o:siemens:siprotec_compact_7rw80_firmware" :
        {"family" : "Siprotec"},
    "cpe:/o:siemens:siprotec_compact_7sj81_firmware" :
        {"family" : "Siprotec"},
    "cpe:/o:siemens:siprotec_compact_7sk81_firmware" :
        {"family" : "Siprotec"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);