Telesquare SKT LTE Router SDT-CS3B1 Multiple Vulnerabilities - Active Check

# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/h:telesquare:sdt-cs3b1";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.812367");
  script_version("2026-03-20T16:33:06+0000");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"last_modification", value:"2026-03-20 16:33:06 +0000 (Fri, 20 Mar 2026)");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2026-03-16 14:17:52 +0000 (Mon, 16 Mar 2026)");
  script_tag(name:"creation_date", value:"2017-12-28 11:04:35 +0530 (Thu, 28 Dec 2017)");
  script_name("Telesquare SKT LTE Router SDT-CS3B1 Multiple Vulnerabilities - Active Check");

  script_tag(name:"summary", value:"Telesquare SKT LTE Router SDT-CS3B1 devices are prone to
  multiple vulnerabilities.");

  script_cve_id("CVE-2017-20221", "CVE-2017-20222", "CVE-2017-20223", "CVE-2017-20224");

  script_tag(name:"vuldetect", value:"Send the crafted http GET request
  and check whether it is able to read the sensitive information or not.");

  script_tag(name:"insight", value:"Multiple vulnerabilities exist as,

  - CVE-2017-20221: Application interface allows users to perform certain actions via
    HTTP requests without performing any validity checks to verify the requests.

  - CVE-2017-20222: Application allows unauthenticated user to execute reboot command.

  - CVE-2017-20223: Application provides direct access to objects based on user-supplied input.

  - CVE-2017-20224: Arbitrary file upload. Unauthenticated attackers can use PUT, DELETE, MKCOL,
  MOVE, COPY, and PROPPATCH methods to upload executable code, delete files, or manipulate server
  content for remote code execution or denial of service.");

  script_tag(name:"impact", value:"Successful exploitation will allow a remote
  attacker to gain access to potentially sensitive information, bypass
  authorization and access resources and functionalities in the system and
  conduct a denial of service condition.");

  script_tag(name:"affected", value:"Telesquare SKT LTE Router SDT-CS3B1 devices in all versions.");

  script_tag(name:"solution", value:"No known solution was made available for at least one year
  since the disclosure of this vulnerability. Likely none will be provided anymore. General solution
  options are to upgrade to a newer release, disable respective features, remove the product or
  replace the product by another one.");

  script_tag(name:"solution_type", value:"WillNotFix");
  script_tag(name:"qod_type", value:"remote_vul");

  script_xref(name:"URL", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5446.php");
  script_xref(name:"URL", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5445.php");
  script_xref(name:"URL", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5444.php");
  script_xref(name:"URL", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5443.php");

  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2017 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_telesquare_skt_lte_router_SDT-CS3B1_detect.nasl");
  script_mandatory_keys("telesquare/SDT-CS3B1/detected");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("http_func.inc");
include("http_keepalive.inc");
include("host_details.inc");

if(!port = get_app_port(cpe:CPE, service:"www"))
  exit(0);

if(!get_app_location(port:port, cpe:CPE, nofork:TRUE))
  exit(0);

url = "/cgi-bin/systemutil.cgi?Command=SystemInfo";

if(http_vuln_check(port:port, url:url, pattern:"<Model>SDT-CS3B1<",
                   extra_check:make_list("<FwVer>SDT-CS3B1", "<LteVer>", "<CMState>", "<uicc_state>"),
                   check_header:TRUE)) {
  report = http_report_vuln_url(port:port, url:url);
  security_message(port:port, data:report);
  exit(0);
}

exit(99);