Yokogawa CENTUM and Exaopc Relative Path Traversal (CVE-2022-21808)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500606);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2022-21808");
  script_xref(name:"ICSA", value:"22-083-01");

  script_name(english:"Yokogawa CENTUM and Exaopc Relative Path Traversal (CVE-2022-21808)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric
products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00,
from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-083-01");
  script_set_attribute(attribute:"solution", value:
'The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Yokogawa recommends updating the following products:

- CENTUM VP: update to R6.09.00 or later
- Exaopc: update to R3.80.00 or later
- CENTUM CS 3000: consider system upgrade to the latest revision of CENTUM VP

The method of obtaining and updating patch software depends on the support contract of each installation. Users who do
not know how to obtain the update and install it should contact their service/sales person.

Please see Yokogawa’s full report (YSAR-22-0001) for update details.

For questions related to this report, please contact Yokogawa security. 

Yokogawa also recommends the following countermeasures:

- Follow the installation instructions for each product and change the password of the OS account created when
installing the product to an appropriate one.
- The initial password is set by default for the predefined user accounts in CENTUM VP and Exaopc. Be sure to change the
initial password.
- When changing the password, ensure that the same password is set in the entire system.
- For more information about lists of the predefined user accounts in CENTUM VP and how to change the password for a
user account, refer to: "CENTUM VP Security Guide"

Yokogawa strongly recommends users establish and maintain a full security program. Security program components include
patch updates, anti-virus, backup and recovery, zoning, hardening, whitelisting, firewalls, etc.

Yokogawa can assist in setting up and running security programs. For considering the most effective risk mitigation
plan, as a starting point, Yokogawa can perform a security risk assessment.

For questions related to this report, please contact Yokogawa.');
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-21808");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/03/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/03/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/03/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_cs_3000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_cs_3000_entry_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_vp_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_vp_entry_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Yokogawa");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Yokogawa');

var asset = tenable_ot::assets::get(vendor:'Yokogawa');

var vuln_cpes = {
    "cpe:/o:yokogawa:centum_cs_3000_firmware" :
        {"versionEndIncluding" : "r3.09.00", "versionStartIncluding" : "r3.08.10", "family" : "CentumVP"},
    "cpe:/o:yokogawa:centum_cs_3000_entry_firmware" :
        {"versionEndIncluding" : "r3.09.00", "versionStartIncluding" : "r3.08.10", "family" : "CentumVP"},
    "cpe:/o:yokogawa:centum_vp_firmware" :
        {"versionEndIncluding" : "r5.04.20", "versionEndExcluding" : "r6.09.00", "versionStartIncluding" : "r6.01.00", "family" : "CentumVP"},
    "cpe:/o:yokogawa:centum_vp_entry_firmware" :
        {"versionEndIncluding" : "r5.04.20", "versionEndExcluding" : "r6.09.00", "versionStartIncluding" : "r6.01.00", "family" : "CentumVP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);