Zyxel NAS Pre-Auth Command Injection vulnerability (CVE-2023-27992)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(200304);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/11");

  script_cve_id("CVE-2023-27992");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/07/14");

  script_name(english:"Zyxel NAS Pre-Auth Command Injection vulnerability (CVE-2023-27992)");

  script_set_attribute(attribute:"synopsis", value:
"The remote security gateway is affected by a remote rode execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Zyxel NAS is potentially affected by a pre-authentication command injection vulnerability. This Zyxel 
device firmware is missing authentication logic which could allow an unauthenticated attacker to execute 
some OS commands remotely by sending crafted packets to an affected device.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported model
number.");
  # https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93d6683b");
  script_set_attribute(attribute:"solution", value:
"See Vendor Advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-27992");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/06/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/06/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:zyxel:nas");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zyxel_device_detect.nbin");
  script_require_keys("installed_sw/Zyxel NAS");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}
include('vcf.inc');
include('vcf_extras.inc');

var app = 'Zyxel NAS';
var app_info = vcf::combined_get_app_info(app:app);
dbg::log(msg:'[app_info][' + obj_rep(app_info) + ']'); 

var model = app_info['model'];
if(empty_or_null(model))
  audit(AUDIT_OS_CONF_UNKNOWN, 'Zyxel device');
var constraints = [];

if ('NAS326' >< model)
{
  constraints = [{
    'max_version'   : vcf::zyxel_router::transform_ver(firmware:'V5.21(AAZF.13)C0'), 
    'fixed_version' : vcf::zyxel_router::transform_ver(firmware:'V5.21(AAZF.14)C0'),
    'fixed_display' : 'V5.21(AAZF.14)C0'
  }];
} 
else if ('NAS540' >< model){
  constraints = [{
    'max_version'   : vcf::zyxel_router::transform_ver(firmware:'V5.21(AATB.10)C0'), 
    'fixed_version' : vcf::zyxel_router::transform_ver(firmware:'V5.21(AATB.11)C0'),
    'fixed_display' : 'V5.21(AATB.11)C0' 
  }];
}
else if ('NAS542' >< model){
  constraints = [{
    'max_version'   : vcf::zyxel_router::transform_ver(firmware:'V5.21(ABAG.10)C0'), 
    'fixed_version' : vcf::zyxel_router::transform_ver(firmware:'V5.21(ABAG.11)C0'),
    'fixed_display' : 'V5.21(ABAG.11)C0'
  }];
}
else
  audit(AUDIT_NOT_INST, 'Zyxel NAS Device');

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);