Westermo L210-F2G Cleartext Transmission of Sensitive Information (CVE-2024-37183)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503310);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2024-37183");
  script_xref(name:"ICSA", value:"24-172-03");

  script_name(english:"Westermo L210-F2G Cleartext Transmission of Sensitive Information (CVE-2024-37183)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Plain text credentials and session ID can be captured with a network
sniffer.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Westermo advises users to disable HTTP access to the WebGUI and instead use HTTPS instead. This change will secure the
credentials and session IDs, effectively nullifying the exploits described.

To mitigate the risk of a denial-of-service attack through continuous login attempts, Westermo recommends disabling
access to the device's WebGUI on external communication interfaces. For devices in production environments, disabling
the WebGUI is suggested if possible.

Westermo suggests limiting access to the device's CLI on external communication interfaces to prevent SSH DOS attacks
through repeated login attempts.

Westermo will keep users updated on any further enhancements.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-37183");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(319);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:westermo:l210-f2g_firmware:4.21.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Westermo");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Westermo');

var asset = tenable_ot::assets::get(vendor:'Westermo');

var vuln_cpes = {
    "cpe:/o:westermo:l210-f2g_firmware:4.21.0" :
        {"versionEndIncluding" : "4.21.0", "versionStartIncluding" : "4.21.0", "family" : "WestermoLynx"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);