Siemens SCALANCE X Authentication Bypass (CVE-2019-13933)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500729);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/12/12");

  script_cve_id("CVE-2019-13933");

  script_name(english:"Siemens SCALANCE X Authentication Bypass (CVE-2019-13933)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in SCALANCE X204RNA (HSR),
SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA
EEC (PRP), SCALANCE X204RNA EEC (PRP/HSR), SCALANCE X302-7 EEC (230V),
SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V),
SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V),
SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V),
SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE
X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V,
coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated),
SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated),
SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated),
SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE
X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD,
SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE
X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M,
SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS,
SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE,
SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE
X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M
(230V, ports on front), SCALANCE XR324-12M (230V, ports on rear),
SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V,
ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE
XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on
rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V),
SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE
XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M
EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC
(100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V,
ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE
XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports
on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear),
SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC
(2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on
rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE
XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V,
ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE
XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V,
ports on front), SIPLUS NET SCALANCE X308-2. Affected devices contain
a vulnerability that allows an unauthenticated attacker to violate
access-control rules. The vulnerability can be triggered by sending
GET request to specific uniform resource locator on the web
configuration interface of the device. The security vulnerability
could be exploited by an attacker with network access to the affected
systems. An attacker could use the vulnerability to obtain sensitive
information or change the device configuration. At the time of
advisory publication no public exploitation of this security
vulnerability was known.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.us-cert.gov/ics/advisories/icsa-20-014-03");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-13933");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/01/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/01/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x-307-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x-307-3_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x-308-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x-310_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x-320-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x204rna_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x408-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300wg_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_x-204rna_firmware" :
        {"versionEndExcluding" : "3.2.7", "family" : "SCALANCEX200", "orderNumbers" : ["6GK5 204-0BA00-2MB2 ","6GK5 204-0BA00-2KB2 ","6GK5 204-0BS00-2NA3","6GK5 204-0BS00-3LA3 ","6GK5 204-0BS00-3PA3 "]},
    "cpe:/o:siemens:scalance_x-307-2_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5 302-7GD00-2EA3 ","6GK5 302-7GD00-2GA3 ","6GK5 302-7GD00-4EA3 ","6GK5 302-7GD00-4GA3 ","6GK5 302-7GD00-1EA3 ","6GK5 302-7GD00-3EA3 ","6GK5 302-7GD00-3GA3 ", ]},
    "cpe:/o:siemens:scalance_x-307-2-eec_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5307-2FD00-2EA3","6GK5307-2FD00-2GA3","6GK5307-2FD00-4EA3","6GK5307-2FD00-4GA3","6GK5307-2FD00-1EA3","6GK5307-2FD00-1GA3","6GK5307-2FD00-3EA3","6GK5307-2FD00-3GA3"]},
    "cpe:/o:siemens:scalance_x-307-3_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5307-3BL00-2AA3","6GK5307-3BL10-2AA3"]},
    "cpe:/o:siemens:scalance_x-307-3ld_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5307-3BM00-2AA3","6GK5307-3BM10-2AA3"]},
    "cpe:/o:siemens:scalance_x-308-2_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2FL00-2AA3","6GK5308-2FL10-2AA3"]},
    "cpe:/o:siemens:scalance_x-308-2ld_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2FM00-2AA3","6GK5308-2FM10-2AA3"]},
    "cpe:/o:siemens:scalance_x-308-2lh_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2FN00-2AA3","6GK5308-2FN10-2AA3","6GK5308-2FP00-2AA3","6GK5308-2FP10-2AA3"]},
    "cpe:/o:siemens:scalance_x-308-2m_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2GG00-2AA2","6GK5308-2GG10-2AA2"]},
    "cpe:/o:siemens:scalance_x-308-2m-poe_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2QG00-2AA2","6GK5308-2QG10-2AA2"]},
    "cpe:/o:siemens:scalance_x-308-2m-ts_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5308-2QG00-2CA2","6GK5308-2QG10-2CA2"]},
    "cpe:/o:siemens:scalance_x-310_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5310-0FA00-2AA3","6GK5310-0FA10-2AA3"]},
    "cpe:/o:siemens:scalance_x-310fe_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5310-0BA00-2AA3","6GK5310-0BA10-2AA3"]},
    "cpe:/o:siemens:scalance_x-320-1-fe_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5320-1BD00-2AA3"]},
    "cpe:/o:siemens:scalance_x-320-1-2ld-fe_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300", "orderNumbers" : ["6GK5320-3BF00-2AA3"]},
    "cpe:/o:siemens:scalance_xr-300wg_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-300_series_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x408-2_firmware" :
        {"versionEndExcluding" : "4.1.3", "family" : "SCALANCEX400", "orderNumbers" : ["6GK5408-2FD00-2AA2"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);