Siemens Industrial Products Intel CPUs Missing Encryption of Sensitive Data (CVE-2020-24513)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500846);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/01");

  script_cve_id("CVE-2020-24513");
  script_xref(name:"DSA", value:"DSA-4934");

  script_name(english:"Siemens Industrial Products Intel CPUs Missing Encryption of Sensitive Data (CVE-2020-24513)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Domain-bypass transient execution vulnerability in some Intel Atom(R)
Processors may allow an authenticated user to potentially enable
information disclosure via local access.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?127ccf8b");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2021/dsa-4934");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-21-222-05");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends updating to the latest software version:

- SIMATIC IPC627E: Update BIOS to v25.02.10
- SIMATIC IPC647E: Update BIOS to v25.02.10
- SIMATIC IPC677E: Update BIOS to v25.02.10
- SIMATIC IPC847E: Update BIOS to v25.02.10
- SINUMERIK One NCU 1740: Update BIOS to v05.00.00.00 or later (Obtained through a Siemens account manager)
- SIMATIC IPC127E: Update BIOS to v21.01.07 or later
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): Update BIOS to v0209_0105 or later
- SIMATIC IPC427E: Update BIOS to v21.01.16 or later
- SIMATIC IPC477E: Update BIOS to v21.01.16 or later
- SIMATIC IPC477E Pro: Update BIOS to v21.01.16 or later 
- SIMATIC ITP1000: Update BIOS to v23.01.10 or later
- SIMATIC Field PG M6: Update BIOS to v21.01.07 or later
- SIMATIC IPC347G: Update BIOS to v01.04.00 or later
- SIMATIC IPC3000 SMART V3: Update BIOS to v01.04.00 or later

- SINUMERIK 828D HW PPU.4: Update BIOS to v08.00.00.00 or later (obtained through a Siemens account manager.)
- SINUMERIK MC MCU 1720: Update BIOS to v05.00.00.00 or later (obtained through a Siemens account manager.)
- SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10: Update BIOS to v08.00.00.00 or later (obtained through a
Siemens account manager.)
- SINUMERIK ONE PPU 1740: Update BIOS to v06.00.00.00 or later (obtained through a Siemens account manager.)

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the
environment according to the Siemens operational guidelines for industrial security and follow the recommendations in
the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-309571");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-24513");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/02/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_open_controller_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_et_200sp_open_controller_firmware" :
        {"versionEndExcluding" : "02090105", "family" : "ET200SP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_NOTE);