WAGO I/O-CHECK Buffer Access with Incorrect Length Value (CVE-2019-5074)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500831);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2019-5074");

  script_name(english:"WAGO I/O-CHECK Buffer Access with Incorrect Length Value (CVE-2019-5074)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable stack buffer overflow vulnerability exists in the
iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware
version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12) and
WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of
packets can cause a stack buffer overflow, resulting in code
execution. An attacker can send unauthenticated packets to trigger
this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0863");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-065-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

WAGO recommends updating to the latest firmware, FW 15 or above. WAGO has identified the following specific workarounds
and mitigations users can apply to reduce the risk:

- The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations.
- It is highly recommended to disable IP Port 6626 after commissioning.
- Disable unused TCP/UDP-ports.
- Restrict network access to the device.
- Do not directly connect the device to the Internet.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-5074");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/02/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc_100_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc_200_firmware:03.01.07%2813%29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Wago");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Wago');

var asset = tenable_ot::assets::get(vendor:'Wago');

var vuln_cpes = {
    "cpe:/o:wago:pfc_200_firmware:03.01.07%2813%29" :
        {"versionEndIncluding" : "03.01.07%2813%29", "versionStartIncluding" : "03.01.07%2813%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc_100_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC100"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);