Zyxel USG FLEX H Series Firewall < 1.30 Privilege Escalation

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237023);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/21");

  script_cve_id("CVE-2024-9677");
  script_xref(name:"IAVA", value:"2024-A-0684-S");

  script_name(english:"Zyxel USG FLEX H Series Firewall < 1.30 Privilege Escalation");

  script_set_attribute(attribute:"synopsis", value:
"The remote security gateway is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"Firmware version of the Zyxel USG is less than uOS 1.30. This means the Zyxel device is vulnerable to a
privilege escalation vulnerability.  The insufficiently protected credentials vulnerability in the CLI 
command of the USG FLEX H series firewalls could allow an authenticated local attacker to gain privilege 
escalation by stealing the authentication token of a login administrator. Note that this attack could be 
successful only if the administrator has not logged out.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2de6acef");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Zyxel USG uOS 1.30 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-9677");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:zyxel:usg_flex");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zyxel_usg_detect.nbin");
  script_require_keys("installed_sw/Zyxel Unified Security Gateway (USG)");
  script_require_ports("Host/Zyxel/USG/uos");

  exit(0);
}

include('vcf.inc');

var app = 'Zyxel Unified Security Gateway (USG)';

var app_info = vcf::get_app_info(app:app);

var model = app_info['Model'];
var constraints = [];

if(empty_or_null(model))
  audit(AUDIT_OS_CONF_UNKNOWN, 'Zyxel device');

if (toupper(model) =~ "USG FLEX [0-9]+HP?") 
  constraints = [{'max_version' : '1.21', 'fixed_display' : '1.30'}];
else 
  audit(AUDIT_NOT_INST, 'Zyxel USG FLEX H Series Device');

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);