Siemens SICAM A8000 Improper Access Control (CVE-2021-45034)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501067);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2021-45034");

  script_name(english:"Siemens SICAM A8000 Improper Access Control (CVE-2021-45034)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O
-25/+70C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O
-40/+70C (All versions < V16.20), CP-8021 MASTER MODULE (All versions
< V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20).
The web server of the affected system allows access to logfiles and
diagnostic data generated by a privileged user. An unauthenticated
attacker could access the files by knowing the corresponding download
links.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-013-02");
  script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2022/Apr/20");
  # http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?42d5421e");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends updating to v16.20 or later.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. To operate the devices in a protected IT environment, Siemens recommends users configure the environment
according to Siemens’ operational guidelines for Industrial Security and follow the recommendations in the product
manuals.

Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

For more information about these vulnerabilities, see Siemens’ security advisory SSA-324998");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-45034");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(532);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/04/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-25%2f%2b70_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-40%2f%2b70_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8021_master_module_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8022_master_module_with_gprs_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-25%2f%2b70_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP800"},
    "cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-40%2f%2b70_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP800"},
    "cpe:/o:siemens:cp-8021_master_module_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP802"},
    "cpe:/o:siemens:cp-8022_master_module_with_gprs_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP802"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);