Cisco Small Business RV Series Routers DoS RCE (cisco-sa-sb-mult-vuln-CbVp4SUR))

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(163884);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/03/23");

  script_cve_id("CVE-2022-20842");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwc00210");
  script_xref(name:"CISCO-SA", value:"cisco-sa-sb-mult-vuln-CbVp4SUR");
  script_xref(name:"IAVA", value:"2022-A-0308");

  script_name(english:"Cisco Small Business RV Series Routers DoS RCE (cisco-sa-sb-mult-vuln-CbVp4SUR))");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Small Business RV Series Router Firmware is affected by a vulnerability.
A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN 
Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to 
restart unexpectedly, resulting in a denial of service (DoS) condition.

Please see the included Cisco BID and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version 
number.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93fea3b4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwc00210");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-20842");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/08/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/08/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/08/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:small_business_rv_series_router_firmware");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_small_business_detect.nasl", "cisco_rv_webui_detect.nbin");
  script_require_keys("Cisco/Small_Business_Router/Version", "Cisco/Small_Business_Router/Model");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Small Business Series Router Firmware');

# CVE-2022-20842 affects the following Cisco products:
# RV340 Dual WAN Gigabit VPN Routers
# RV340W Dual WAN Gigabit Wireless-AC VPN Routers
# RV345 Dual WAN Gigabit VPN Routers
# RV345P Dual WAN Gigabit POE VPN Routers

if (product_info['model'] !~ "^RV(34[05]+[WP]*)")
  audit(AUDIT_HOST_NOT, 'an affected Cisco Small Business RV Series router'); 

var vuln_ranges = [ { 'min_ver' : '1.0.03.26', 'fix_ver' : '1.0.03.27'} ];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwc00210',
  'fix'           , '1.0.03.28',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);