Siemens CPC80 Firmware of SICAM A8000 Missing Release of Resource After Effective Lifetime (CVE-2022-29884)

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500664);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2022-29884");

  script_name(english:"Siemens CPC80 Firmware of SICAM A8000 Missing Release of Resource After Effective Lifetime (CVE-2022-29884)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70C (All versions < CPC80 V16.30), CP-8000
MASTER MODULE WITH I/O -40/+70C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30),
CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions,
affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device
into a denial of service condition.

  - A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70C (All versions < CPC80
    V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE
    (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using
    the HTTPS server under specific conditions, affected devices do not properly free resources. This could
    allow an unauthenticated remote attacker to put the device into a denial of service condition.
    (CVE-2022-29884)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-14");
  script_set_attribute(attribute:"solution", value:
'The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends updating to the latest version:

- CP-8000 MASTER MODULE WITH I/O -25/+70°C (6MF2101-0AB10-0AA0): Update to versions CPC80 v16.30 or later
- CP-8000 MASTER MODULE WITH I/O -40/+70°C" (6MF2101-1AB10-0AA0): Update to versions CPC80 v16.30 or later
- CP-8021 MASTER MODULE (6MF2802-1AA00): Update to versions CPC80 v16.30 or later
- CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00): Update to versions CPC80 v16.30 or later

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

- Limit access to port 443/tcp to trusted IP addresses and avoid opening untrusted files from unknown sources in
affected products.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’
Operational Guidelines for Industrial Security and following recommendations in the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-491621');
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-29884");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(772);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/07/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/07/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:sicam_a8000_cp-8000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:sicam_a8000_cp-8021_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:sicam_a8000_cp-8022_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:sicam_a8000_cp-8000_firmware" :
        {"versionEndExcluding" : "16.30", "family" : "SicamA8000CP800"},
    "cpe:/o:siemens:sicam_a8000_cp-8021_firmware" :
        {"versionEndExcluding" : "16.30", "family" : "SicamA8000CP802"},
    "cpe:/o:siemens:sicam_a8000_cp-8022_firmware" :
        {"versionEndExcluding" : "16.30", "family" : "SicamA8000CP802"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);