Siemens Ruggedcom ROS, SCALANCE Improper Access Control (CVE-2017-12736)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501024);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2017-12736");

  script_name(english:"Siemens Ruggedcom ROS, SCALANCE Improper Access Control (CVE-2017-12736)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in RUGGEDCOM ROS for RSL910
devices (All versions < ROS V5.0.1), RUGGEDCOM ROS for all other
devices (All versions < ROS V4.3.4), SCALANCE
XB-200/XC-200/XP-200/XR300-WG (All versions between V3.0 (including)
and V3.0.2 (excluding)), SCALANCE XR-500/XM-400 (All versions between
V6.1 (including) and V6.1.1 (excluding)). After initial configuration,
the Ruggedcom Discovery Protocol (RCDP) is still able to writeto the
device under certain conditions, potentially allowing users located in
the adjacentnetwork of the targeted device to perform unauthorized
administrative actions.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/101041");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039463");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039464");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-17-271-01b");
  # https://cert-portal.siemens.com/productcert/pdf/ssa-856721.pdf
  script_set_attribute(attribute:"see_also", value:"https://www.nessus.org/u?2b1d4444");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens provides new versions to mitigate this vulnerability and recommends users update to the newest version.

- RUGGEDCOM ROS for RSL910 devices: Install V5.0.1
- RUGGEDCOM ROS for all other devices: Install V4.3.4

The firmware updates for the Ruggedcom ROS-based devices can be obtained by contacting the Ruggedcom support team at:

https://support.industry.siemens.com/my/us/en/requests

- SCALANCE XB-200/XC-200/XP-200/XR300-WG: Install V3.0.2

https://support.industry.siemens.com/cs/de/en/view/109754174

- SCALANCE XR-500/XM-400: Install V6.1

https://support.industry.siemens.com/cs/ww/de/view/109755475

Siemens is preparing updates for the remaining affected products and recommends that users manually deactivate RCDP
according to the instructions in the user guide. The user guide can be found on the Siemens web site at the following
location:

https://support.industry.siemens.com/cs/ww/en/view/109748693

As a general security measure, Siemens advises configuring the IT environment according to Siemens operational
guidelines in order to run the devices in a protected manner.

https://www.siemens.com/cert/operational-guidelines-industrial-security

For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security
Advisory SSA-856721 at the following location:

http://www.siemens.com/cert/en/cert-security-advisories.htm");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12736");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(665);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/04/11");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xb-200_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-200_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xm-400_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xp-200_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr300-wg_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_xb-200_series_firmware" :
        {"versionEndExcluding" : "3.0.2", "versionStartIncluding" : "3.0", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xc-200_series_firmware" :
        {"versionEndExcluding" : "3.0.2", "versionStartIncluding" : "3.0", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xp-200_series_firmware" :
        {"versionEndExcluding" : "3.0.2", "versionStartIncluding" : "3.0", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xr300-wg_series_firmware" :
        {"versionEndExcluding" : "3.0.2", "versionStartIncluding" : "3.0", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-500_series_firmware" :
        {"versionEndExcluding" : "6.1.1", "versionStartIncluding" : "6.1", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xm-400_series_firmware" :
        {"versionEndExcluding" : "6.1.1", "versionStartIncluding" : "6.1", "family" : "SCALANCEX400"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);