WAGO I/O-CHECK Missing Authentication For Critical Function (CVE-2019-5078)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500824);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2019-5078");

  script_name(english:"WAGO I/O-CHECK Missing Authentication For Critical Function (CVE-2019-5078)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable denial of service vulnerability exists in the iocheckd
service I/O-Check functionality of WAGO PFC200 Firmware versions
03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version
03.00.39(12). A specially crafted set of packets can cause a denial of
service, resulting in the device entering an error state where it
ceases all network communications. An attacker can send
unauthenticated packets to trigger this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0870");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-065-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

WAGO recommends updating to the latest firmware, FW 15 or above. WAGO has identified the following specific workarounds
and mitigations users can apply to reduce the risk:

- The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations.
- It is highly recommended to disable IP Port 6626 after commissioning.
- Disable unused TCP/UDP-ports.
- Restrict network access to the device.
- Do not directly connect the device to the Internet.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-5078");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/02/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc_100_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc_200_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc_200_firmware:03.01.07%2813%29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Wago");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Wago');

var asset = tenable_ot::assets::get(vendor:'Wago');

var vuln_cpes = {
    "cpe:/o:wago:pfc_200_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc_200_firmware:03.01.07%2813%29" :
        {"versionEndIncluding" : "03.01.07%2813%29", "versionStartIncluding" : "03.01.07%2813%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc_100_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC100"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);