Siemens LOGO! V8.3 BM Devices Plaintext Storage of a Password (CVE-2024-39922)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502370);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/04/28");

  script_cve_id("CVE-2024-39922");
  script_xref(name:"ICSA", value:"24-228-05");

  script_name(english:"Siemens LOGO! V8.3 BM Devices Plaintext Storage of a Password (CVE-2024-39922)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"LOGO! V8.3 BM (incl. SIPLUS variants) devices contain a plaintext
storage of a password vulnerability. This could allow an attacker
with phyiscal access to an affected device to extract user-set
passwords from an embedded storage IC.

Siemens has released new hardware versions with the LOGO! V8.4 BM
product family for several affected devices in which the
vulnerability is fixed. Siemens is working on new hardware versions
for the SIPLUS devices to address this issue further.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-921449.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-05");
  script_set_attribute(attribute:"solution", value:
'The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- Currently no fix is planned
- Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational
guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-921449 in HTML and CSAF.');
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39922");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(256);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:logo%21_8_bm_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_logo%21_8_bm_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:logo%21_8_bm_firmware" :
        {"family" : "LOGO!BM", "orderNumbers": ["6ED1052-1MD08-0BA1","6ED1052-2MD08-0BA1","6ED1052-1CC08-0BA1","6ED1052-2CC08-0BA1","6ED1052-1HB08-0BA1","6ED1052-2HB08-0BA1","6ED1052-1FB08-0BA1","6ED1052-2FB08-0BA1"]},
    "cpe:/o:siemens:siplus_logo%21_8_bm_firmware" :
        {"family" : "LOGO!BM", "orderNumber": ["6AG1052-1MD08-7BA1","6AG1052-2MD08-7BA1","6AG1052-1CC08-7BA1","6AG1052-2CC08-7BA1","6AG1052-1HB08-7BA1","6AG1052-2HB08-7BA1","6AG1052-1FB08-7BA1","6AG1052-2FB08-7BA1"]},
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);