Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays Improper Input Validation (CVE-2018-11451)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500874);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/01");

  script_cve_id("CVE-2018-11451");

  script_name(english:"Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays Improper Input Validation (CVE-2018-11451)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in Firmware variant IEC 61850 for
EN100 Ethernet module (All versions < V4.33), Firmware variant
PROFINET IO for EN100 Ethernet module (All versions), Firmware variant
Modbus TCP for EN100 Ethernet module (All versions), Firmware variant
DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant
IEC104 for EN100 Ethernet module (All versions < V1.22), SIPROTEC 5
relays with CPU variants CP300 and CP100 and the respective Ethernet
communication modules (All versions < V7.80), SIPROTEC 5 relays with
CPU variants CP200 and the respective Ethernet communication modules
(All versions < V7.58). Specially crafted packets to port 102/tcp
could cause a denial-of-service condition in the affected products. A
manual restart is required to recover the EN100 module functionality
of the affected devices. Successful exploitation requires an attacker
with network access to send multiple packets to the affected products
or modules. As a precondition the IEC 61850-MMS communication needs to
be activated on the affected products or modules. No user interaction
or privileges are required to exploit the vulnerability. The
vulnerability could allow causing a Denial-of-Service condition of the
network functionality of the device, compromising the availability of
the system. At the time of advisory publication no public exploitation
of this security vulnerability was known.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-18-347-02");
  script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/bid/106221");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has released updates for several affected products. Siemens is working on updates for the remaining affected
products, and recommends specific countermeasures until fixes are available.

- Firmware variant IEC 61850 for EN100 Ethernet module: Update to
v4.33https://support.industry.siemens.com/cs/us/en/view/109745821.

- Firmware variant IEC104 for EN100 Ethernet module: Update to v1.22
https://support.industry.siemens.com/cs/us/en/view/109745821

- SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules: Update to
firmware Version 7.80 for the device types listed in SSA-635129.
- SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules: Update to firmware
Version 7.58 for the device types listed in SSA-635129.

The firmware version for the communications modules can also be found on each device’s download page. Applying the
update causes the device / module / program to undergo a single restart cycle.

Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented
procedures made available with the product. If supported by the product, an automated means to apply the security
updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security
update before being applied, and supervision by trained staff of the update process in the target environment.

Until updates can be applied, Siemens recommends blocking access to Port 102/TCP with an external firewall.

As a general security measure Siemens strongly recommends protecting network access with appropriate mechanisms (e.g.
firewalls, segmentation, VPN). It is advised that users configure the environment according to Siemens operational
guidelines in order to run the devices in a protected IT environment.

Siemens recommended security guidelines to secure substations can be found at:

https://www.siemens.com/gridsecurity

Additional information on industrial security by Siemens can be found at:

https://www.siemens.com/industrialsecurity

For more information on this vulnerability and associated software updates, please see Siemens security advisory
SSA-635129 on their website:

https://www.siemens.com/cert/advisories");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-11451");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/07/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/01");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md86_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ss85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ke85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7um85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa87_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd87_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl87_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7vk87_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa86_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd86_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl86_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut82_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut86_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut87_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
  "cpe:/o:siemens:siprotec_5_6md85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_6md86_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ss85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ke85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7um85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sa87_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sd87_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sl87_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7vk87_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sa82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sa86_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sd82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sd86_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sl82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sl86_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sk82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sk85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sj82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7sj85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ut82_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ut85_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ut86_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
  "cpe:/o:siemens:siprotec_5_7ut87_firmware" :
      {"versionEndExcluding" : "7.80", "family" : "Siprotec5"},
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);