ABB CP635 HMI Use of Hard-Coded Credentials (CVE-2019-7225)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500947);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/25");

  script_cve_id("CVE-2019-7225");

  script_name(english:"ABB CP635 HMI Use of Hard-Coded Credentials (CVE-2019-7225)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The ABB HMI components implement hidden administrative accounts that
are used during the provisioning phase of the HMI interface. These
credentials allow the provisioning tool Panel Builder 600 to flash a
new interface and Tags (MODBUS coils) mapping to the HMI. These
credentials are the idal123 password for the IdalMaster account, and
the exor password for the exor account. These credentials are used
over both HTTP(S) and FTP. There is no option to disable or change
these undocumented credentials. An attacker can use these credentials
to login to ABB HMI to read/write HMI configuration files and also to
reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel
Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI
components.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://packetstormsecurity.com/files/153397/ABB-HMI-Hardcoded-Credentials.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b208a2f6");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-19-178-03");
  # https://www.darkmatter.ae/xen1thlabs/abb-hmi-hardcoded-credentials-vulnerability-xl-19-009/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?879c0406");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-19-178-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

ABB recommends users apply the BSP update on affected CP600 control panels at their earliest convenience.

- New version of PB610 Panel Builder 600 v2.8.0.424, which is provided via Automation Builder 2.2 SP2.
- New version of BSP (board support package) UN31 v2.31.

Please see ABB cybersecurity advisory document number 3ADR010376 for more information about this vulnerability, and two
other security issues and their mitigations.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-7225");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(798);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/03/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp620-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp620_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp630-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp630_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635-b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp635_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp651-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp651_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp661-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp661_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp665-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp665_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp676-web_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:abb:cp676_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:abb:cp620_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp620-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp630_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp630-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635-b_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp635-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp651-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp661_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp661-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp665_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp665-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp676_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp676-web_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"},
    "cpe:/o:abb:cp651_firmware" :
        {"versionEndIncluding" : "1.76", "family" : "Abb800xA"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);