Wind River VxWorks 7 < 26.09 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(358456);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id("CVE-2026-97686", "CVE-2026-102004", "CVE-2026-102006");

  script_name(english:"Wind River VxWorks 7 < 26.09 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote VxWorks device is potentially affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote device is running Wind River VxWorks 7 prior to release 26.09. It
is, therefore, affected by multiple vulnerabilities:

  - In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the
    memory management subsystem. (CVE-2026-102004)

  - In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management
    subsystem failing to properly release allocated kernel memory before terminating the calling application.
    (CVE-2026-102006)

  - In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to
    properly release allocated kernel memory and system file descriptors before terminating the calling application.
    (CVE-2026-97686)

Note that Nessus cannot determine the VxWorks 7 release designation (for example 26.09) from the detected operating
system version, so an affected release cannot be distinguished from one that already includes the fix. This finding is
therefore reported as a potential vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the OS version.");
  # https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2026-97686
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56829c79");
  # https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2026-102006
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6361c599");
  # https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2026-102004
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?929bb04f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Wind River VxWorks 7 release 26.09 or later, or contact the device vendor to obtain the appropriate
update.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102004");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:windriver:vxworks");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("windriver_vxworks_rtos_detect.nbin");
  script_require_keys("Host/VxWorks", "Settings/ParanoidReport");

  exit(0);
}

get_kb_item_or_exit('Host/VxWorks');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var version = get_kb_item('Host/VxWorks/version');
if (empty_or_null(version))
  version = 'unknown';

# Only the VxWorks 7 line is affected. The detected OS version does not expose the
# release designation (e.g. 26.09), so an affected 7.x host cannot be distinguished
# from one already running the fixed release.
if (version != 'unknown' && version !~ "^7([^0-9]|$)")
  audit(AUDIT_OS_RELEASE_NOT, 'VxWorks', '7', version);

var report =
  '\n  Installed version : ' + version +
  '\n  Fixed version     : 26.09' +
  '\n';

security_report_v4(port:0, severity:SECURITY_WARNING, extra:report);