Cisco Nexus 3000 Series and 9000 Series Switches in NX-OS Mode CLI Command Software Image Signature Verification (CVE-2019-1810)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501321);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1810");

  script_name(english:"Cisco Nexus 3000 Series and 9000 Series Switches in NX-OS Mode CLI Command Software Image Signature Verification (CVE-2019-1810)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Image Signature Verification feature used in an
NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches
could allow an authenticated, local attacker with administrator-level
credentials to install a malicious software image on an affected
device. The vulnerability exists because software digital signatures
are not properly verified during CLI command execution. An attacker
could exploit this vulnerability to install an unsigned software image
on an affected device. Note: If the device has not been patched for
the vulnerability previously disclosed in the Cisco Security Advisory
cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the
attacker to boot a malicious software image.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5b1dda9");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/108431");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1810");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(347);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.0%283%29i7%285%29" :
        {"versionEndExcluding" : "7.0%283%29i7%285%29", "versionStartIncluding" : "6.1%282%29i3%284%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:9.2%282%29" :
        {"versionEndExcluding" : "9.2%282%29", "versionStartIncluding" : "7.0%283%29i7%285a%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%281%29" :
        {"versionEndExcluding" : "7.0%283%29i7%281%29", "versionStartIncluding" : "7.0%283%29i3%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:9.2%281%29" :
        {"versionEndExcluding" : "9.2%281%29", "versionStartIncluding" : "7.0%283%29i7%282%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);