Siemens SCALANCE Improper Input Validation (CVE-2020-26145)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505319);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2020-26145");
  script_xref(name:"ICSA", value:"22-104-04");

  script_name(english:"Siemens SCALANCE Improper Input Validation (CVE-2020-26145)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The
WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent)
broadcast fragments even when sent in plaintext and process them as
full unfragmented frames. An adversary can abuse this to inject
arbitrary network packets independent of the network configuration.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-913875.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109805887/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-04");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-26145");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/05/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam763-1_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_%28us%29_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_eec_%28us%29_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_eec_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum763-1_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum766-1_%28usa%29_firmware:1.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum766-1_firmware:1.2.0");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_wam763-1_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5763-1AL00-7DA0']},
    "cpe:/o:siemens:scalance_wam766-1_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7DA0']},
    "cpe:/o:siemens:scalance_wam766-1_%28us%29_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7DB0']},
    "cpe:/o:siemens:scalance_wam766-1_eec_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7TA0']},
    "cpe:/o:siemens:scalance_wam766-1_eec_%28us%29_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7TB0']},
    "cpe:/o:siemens:scalance_wum763-1_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5763-1AL00-3DA0', '6GK5763-1AL00-3AA0']},
    "cpe:/o:siemens:scalance_wum766-1_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-3DA0']},
    "cpe:/o:siemens:scalance_wum766-1_%28usa%29_firmware:1.2.0" :
        {"versionEndExcluding" : "1.2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-3DB0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);