Siemens SIMATIC S7-200 SMART Devices Uncontrolled Resource Consumption (CVE-2024-43647)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502482);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/12/12");

  script_cve_id("CVE-2024-43647");
  script_xref(name:"ICSA", value:"24-261-01");

  script_name(english:"Siemens SIMATIC S7-200 SMART Devices Uncontrolled Resource Consumption (CVE-2024-43647)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Affected devices do not properly handle TCP packets with an incorrect
structure. This could allow an unauthenticated remote attacker to
cause a denial of service condition. To restore normal operations, the
network cable of the device needs to be unplugged and re-plugged.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-969738.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations that users can apply to reduce the risk:

- Limit network access to trusted users and systems only

Please use the following General Security Recommendations:

As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the
environment according to Siemens' operational guidelines for Industrial Security, and to follow the recommendations in
the product manuals. Additional information on Industrial Security by Siemens can be found here.

For further inquiries on security vulnerabilities in Siemens products and solutions, please view contact the Siemens
ProductCERT

For more information see the associated Siemens security advisory SSA-969738 in HTML and CSAF.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:T/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-43647");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/08");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_cr40_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_cr60_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_sr20_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_sr30_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_sr40_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_sr60_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_st20_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_st30_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_st40_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-200_smart_cpu_st60_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_cr40_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1CR40-0AA0"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_cr60_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1CR60-0AA0"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_sr20_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1SR20-0AA0", "6ES7288-1SR20-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_sr30_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1SR30-0AA0", "6ES7288-1SR30-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_sr40_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1SR40-0AA0", "6ES7288-1SR40-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_sr60_firmware_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1SR60-0AA0", "6ES7288-1SR60-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_st20_firmware_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1ST20-0AA0", "6ES7288-1ST20-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_st30_firmware_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1ST30-0AA0", "6ES7288-1ST30-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_st40_firmware_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1ST40-0AA0", "6ES7288-1ST40-0AA1"]},
    "cpe:/o:siemens:simatic_s7-200_smart_cpu_st60_firmware_firmware" :
        {"family" : "S7200", "orderNumbers": ["6ES7288-1ST60-0AA0", "6ES7288-1ST60-0AA1"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);