Yokogawa CENTUM Improper Authentication (CVE-2020-5608)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500470);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2020-5608");

  script_name(english:"Yokogawa CENTUM Improper Authentication (CVE-2020-5608)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small,
Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote
unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors.   This
plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://jvn.jp/vu/JVNVU97997181/index.html");
  script_set_attribute(attribute:"see_also", value:"https://web-material3.yokogawa.com/1/29820/files/YSAR-20-0001-E.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-224-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Yokogawa recommends the following mitigations: 

- Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later. 

- For CENTUM CS 3000 (including CENTUM CS 3000 Entry Class) R3.08.10 – R3.09.50 and CENTUM VP (including CENTUM VP Entry
Class) R4.01.00 – R4.03.00, no patch will be available because these products are already end of support. Yokogawa
recommends that affected customers upgrade to the latest revision of CENTUM VP.
- For CENTUM VP (including CENTUM VP Entry Class) R5.01.00 – R5.04.20, apply patch R5.04.D1
- For CENTUM VP (including CENTUM VP Entry Class) R6.01.00 – R6.07.00, apply patch R6.07.11
- For B/M9000CS R5.04.01 – R5.05.01 and B/M9000 VP R6.01.01 – R8.03.01, Yokogawa reports that this product is not
affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM
CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to
B/M90000 VP to suitable revision.

For questions related to this report, please contact Yokogawa support.

More details can also be found in Yokogawa’s security advisory report number YSAR-20-0001");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5608");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_cs_3000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_vp_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Yokogawa");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Yokogawa');

var asset = tenable_ot::assets::get(vendor:'Yokogawa');

var vuln_cpes = {
    "cpe:/o:yokogawa:centum_cs_3000_firmware" :
        {"versionEndIncluding" : "r3.09.50", "versionStartIncluding" : "r3.08.10", "family" : "CentumVP"},
    "cpe:/o:yokogawa:centum_vp_firmware" :
        {"versionEndIncluding" : "r6.07.00", "versionStartIncluding" : "r6.01.00", "family" : "CentumVP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);