Wago PFC200 Cloud Connectivity TimeoutUnconfirmed Command Injection (CVE-2019-5157)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500913);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/08/24");

  script_cve_id("CVE-2019-5157");

  script_name(english:"Wago PFC200 Cloud Connectivity TimeoutUnconfirmed Command Injection (CVE-2019-5157)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable command injection vulnerability exists in the Cloud
Connectivity functionality of WAGO PFC200 Firmware versions
03.02.02(14), 03.01.07(13), and 03.00.39(12). An attacker can inject
OS commands into the TimeoutUnconfirmed parameter value contained in
the Firmware Update command.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0950");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-5157");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc200_firmware:03.00.39%2812%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc200_firmware:03.01.07%2813%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:pfc200_firmware:03.02.02%2814%29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Wago");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Wago');

var asset = tenable_ot::assets::get(vendor:'Wago');

var vuln_cpes = {
    "cpe:/o:wago:pfc200_firmware:03.00.39%2812%29" :
        {"versionEndIncluding" : "03.00.39%2812%29", "versionStartIncluding" : "03.00.39%2812%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc200_firmware:03.01.07%2813%29" :
        {"versionEndIncluding" : "03.01.07%2813%29", "versionStartIncluding" : "03.01.07%2813%29", "family" : "ControllerPFC200"},
    "cpe:/o:wago:pfc200_firmware:03.02.02%2814%29" :
        {"versionEndIncluding" : "03.02.02%2814%29", "versionStartIncluding" : "03.02.02%2814%29", "family" : "ControllerPFC200"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);