Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Insecure Fabric Authentication (CVE-2019-1590)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501230);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1590");

  script_name(english:"Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Insecure Fabric Authentication (CVE-2019-1590)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Transport Layer Security (TLS) certificate
validation functionality of Cisco Nexus 9000 Series Application
Centric Infrastructure (ACI) Mode Switch Software could allow an
unauthenticated, remote attacker to perform insecure TLS client
authentication on an affected device. The vulnerability is due to
insufficient TLS client certificate validations for certificates sent
between the various components of an ACI fabric. An attacker who has
possession of a certificate that is trusted by the Cisco Manufacturing
CA and the corresponding private key could exploit this vulnerability
by presenting a valid certificate while attempting to connect to the
targeted device. An exploit could allow the attacker to gain full
control of all other components within the ACI fabric of an affected
device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-aci-insecure-fabric
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fa077983");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1590");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(295);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:14.1%280.90%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8.3%280%29sk%280.39%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:8.3%280%29sk%280.39%29" :
        {"versionEndIncluding" : "8.3%280%29sk%280.39%29", "versionStartIncluding" : "8.3%280%29sk%280.39%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:14.1%280.90%29" :
        {"versionEndIncluding" : "14.1%280.90%29", "versionStartIncluding" : "14.1%280.90%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);