Siemens SCALANCE X-300 Switches Cross-Site Request Forgery (CVE-2022-25754)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500760);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/11");

  script_cve_id("CVE-2022-25754");

  script_name(english:"Siemens SCALANCE X-300 Switches Cross-Site Request Forgery (CVE-2022-25754)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in SCALANCE X302-7 EEC (230V),
SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V),
SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V),
SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V),
SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE
X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V,
coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated),
SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated),
SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated),
SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE
X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD,
SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE
X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M,
SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS,
SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE,
SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE
X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M
(230V, ports on front), SCALANCE XR324-12M (230V, ports on rear),
SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V,
ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE
XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on
rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V),
SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE
XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M
EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC
(100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V,
ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE
XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports
on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear),
SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC
(2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on
rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE
XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V,
ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE
XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V,
ports on front), SIPLUS NET SCALANCE X308-2. The integrated web server
of the affected device could allow remote attackers to perform actions
with the permissions of a victim user, provided the victim user has an
active session and is induced to trigger the malicious request.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-09");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends upgrading all X-300 switch family devices to v4.1.4 or later.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:

- Restrict access to the affected systems, especially to Ports 22/TCP, 161/UDP, and 443/TCP and use trusted IP addresses
only.
- Disable SNMP service, if possible.
- Deactivate the webserver if not required, and if deactivation is supported by the product.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the
environment according to the Siemens operational guidelines for industrial security and follow the recommendations in
the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-836527");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-25754");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(352);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/01/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x302-7eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x304-2fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x306-1ldfe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-2eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-3_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-3ld_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2ld_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2lh%2b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2lh_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2m_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x310_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x310fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x320-1-2ldfe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x320-1fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x408-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-12m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-12m_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_poe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_poe_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_net_scalance_x308-2_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_x302-7eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x304-2fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x306-1ldfe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-2eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-3_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-3ld_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2ld_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2lh_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2lh%2b_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2m_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2m_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x310_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x310fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x320-1fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x320-1-2ldfe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x408-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr324-4m_eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-4m_poe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-4m_poe_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-12m_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-12m_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:siplus_net_scalance_x308-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);