Linux Distros Unpatched Vulnerability : CVE-2026-19741

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(375164);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/03");

  script_cve_id("CVE-2026-19741");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-19741");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default J01NME in
    modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then
    subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout
    the public OpenThread and Thread commissioning documentation, including Zephyr's own
    samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with
    CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known
    joining credential compiled in, with no build-time or run-time warning. The PSKd is the only value that
    authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after
    which the commissioner supplies the full operational dataset. In ot_configure_instance()
    (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the
    configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated
    attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or
    after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the
    handshake, and hand the device an attacker-controlled operational dataset. The device then joins and
    enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and
    spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the
    device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only
    application-layer security with independently provisioned credentials survives. Exposure is limited to
    builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no
    in-tree sample uses the vulnerable combination. The fix removes the default from
    CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only
    under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is
    configured. Products should provision a per-device PSKd from factory data and call otJoinerStart() from
    the application rather than relying on a credential compiled identically into every unit. (CVE-2026-19741)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-19741");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-19741");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.10");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:zephyr");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Ubuntu Linux-16.04", "Host/OS/Ubuntu Linux-18.04", "Host/OS/Ubuntu Linux-20.04", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04", "Host/OS/Ubuntu Linux-26.10");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Ubuntu Linux-16.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "16.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-18.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "18.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-20.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "20.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-22.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "22.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-24.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "24.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.04",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.10": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.10",
        "pkgs": [
          {"reference": "zephyr"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}