WAGO I/O-CHECK Buffer Copy Without Checking Size of Input (CVE-2019-5082)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500911);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/11");

  script_cve_id("CVE-2019-5082");

  script_name(english:"WAGO I/O-CHECK Buffer Copy Without Checking Size of Input (CVE-2019-5082)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable heap buffer overflow vulnerability exists in the
iocheckd service I/O-Check functionality of WAGO PFC200 Firmware
version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12), and
WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of
packets can cause a heap buffer overflow, potentially resulting in
code execution. An attacker can send unauthenticated packets to
trigger this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0874");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-065-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

WAGO recommends updating to the latest firmware, FW 15 or above. WAGO has identified the following specific workarounds
and mitigations users can apply to reduce the risk:

- The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations.
- It is highly recommended to disable IP Port 6626 after commissioning.
- Disable unused TCP/UDP-ports.
- Restrict network access to the device.
- Do not directly connect the device to the Internet.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-5082");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/01/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc100_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc200_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc200_firmware:03.01.07%2813%29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Wago");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Wago');

var asset = tenable_ot::assets::get(vendor:'Wago');

var vuln_cpes = {
    "cpe:/o:wago:pfc200_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc200_firmware:03.01.07%2813%29" :
        {"versionEndIncluding" : "03.01.07%2813%29", "versionStartIncluding" : "03.01.07%2813%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc100_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC100"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);