Uniview IP Cameras Improper Authentication (CVE-2023-0773)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506029);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2023-0773");

  script_name(english:"Uniview IP Cameras Improper Authentication (CVE-2023-0773)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Some Uniview IPC products have an access control vulnerability in
their web-based management interface. A remote, unauthenticated
attacker can send specially crafted HTTP requests to modify device
user credentials.

Successful exploitation of this vulnerability could allow the attacker
to gain complete control of the targeted device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://global.uniview.com/About_Us/Security/Notice/202309/976482_140493_0.htm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?665f6a51");
  # https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0270
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b610b7cd");
  script_set_attribute(attribute:"solution", value:
"Upgrade the device to the fixed firmware build for its release branch,
as listed in Uniview security notice USRC-202309-01:

- CIPC-B2303.3.3.230322 or later
- DIPC-B1213.7.2.230315 or later
- DIPC-B1216.6.2.230315 or later
- DIPC-B1219.2.71.230221 or later
- DIPC-B1221.5.2.230315 or later
- DIPC-B1222.5.2.230309 or later
- DIPC-B1223.5.3.230324 or later
- DIPC-B1225.5.2.230315 or later
- DIPC-B1226.5.2.230315 or later
- DIPC-B1228.5.3.230324 or later
- DIPC-B1229.1.69.230515 or later");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-0773");

  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:uniview:ipc322lb-sf28-a_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Uniview");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Uniview');

var asset = tenable_ot::assets::get(vendor:'Uniview');

# One entry per affected branch from USRC-202309-01, as branches are not mutually
# ordered. The CPE suffix is that branch, not a model, and only keeps the keys unique.
var vuln_cpes = {
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:cipc-b2303" :
        {"versionEndIncluding" : "CIPC-B2303.2.8.230105", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1213" :
        {"versionEndIncluding" : "DIPC-B1213.6.5.230215", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1216" :
        {"versionEndIncluding" : "DIPC-B1216.5.7.230109", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1219" :
        {"versionEndIncluding" : "DIPC-B1219.2.67.221019", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1221" :
        {"versionEndIncluding" : "DIPC-B1221.3.5.221202", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1222" :
        {"versionEndIncluding" : "DIPC-B1222.3.8.230223", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1223" :
        {"versionEndIncluding" : "DIPC-B1223.3.3.221123", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1225" :
        {"versionEndIncluding" : "DIPC-B1225.3.3.221123", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1226" :
        {"versionEndIncluding" : "DIPC-B1226.3.6.230105", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1228" :
        {"versionEndIncluding" : "DIPC-B1228.2.65.230207", "family" : "UniviewIPCameras"},
    "cpe:/o:uniview:ipc322lb-sf28-a_firmware:dipc-b1229" :
        {"versionEndIncluding" : "DIPC-B1229.1.67.230104", "family" : "UniviewIPCameras"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);