CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
AI Score
Confidence
High
EPSS
Percentile
80.0%
Devices running Cisco IOS Software or IOS XE Software contain vulnerabilities within the Internet Key Exchange (IKE) version 2 subsystem that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit these vulnerabilities by sending malformed IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause a reload of the affected device or excessive consumption of resources that would lead to a DoS condition. IKEv2 is automatically enabled on devices running Cisco IOS and Cisco IOS XE Software when the Internet Security Association and Key Management Protocol (ISAKMP) is enabled. These vulnerabilities can only be triggered by sending malformed IKEv2 packets.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(501828);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");
script_cve_id("CVE-2015-0643");
script_xref(name:"ICSA", value:"17-094-04");
script_name(english:"Rockwell Automation Stratix 5900 (CVE-2015-0643)");
script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
script_set_attribute(attribute:"description", value:
"Devices running Cisco IOS Software or IOS XE Software contain
vulnerabilities within the Internet Key Exchange (IKE) version 2
subsystem that could allow an unauthenticated, remote attacker
to cause a denial of service (DoS) condition.
The vulnerabilities are due to how an affected device processes
certain malformed IKEv2 packets. An attacker could exploit these
vulnerabilities by sending malformed IKEv2 packets to an affected
device to be processed. A successful exploit could allow the attacker
to cause a reload of the affected device or excessive consumption of
resources that would lead to a DoS condition. IKEv2 is automatically
enabled on devices running Cisco IOS and Cisco IOS XE Software when
the Internet Security Association and Key Management Protocol (ISAKMP)
is enabled. These vulnerabilities can only be triggered by sending
malformed IKEv2 packets.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ikev2
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2da1bc1b");
# https://www.rockwellautomation.com/en-us/support/advisory.PN965.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?141f2981");
# https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7bf8ef2");
script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04");
script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.
Rockwell Automation has provided a new firmware version, Version 15.6.3, to mitigate these vulnerabilities.
Rockwell Automation encourages users of the affected versions to update to the latest available software versions
addressing the associated risk, and including improvements to further harden the software and enhance its resilience
against similar malicious attacks. Users can find the latest firmware version by searching for their device at the
following web site:
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=15
Additional precautions and risk mitigation strategies specific to these types of attacks are recommended in the Rockwell
Automation security release. When possible, multiple strategies should be implemented simultaneously.
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041191
Please also refer to CiscoΓ’ΒΒs security advisories (linked below) for additional workarounds and details for these
vulnerabilities.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-0643");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(755);
script_set_attribute(attribute:"vuln_publication_date", value:"2015/03/26");
script_set_attribute(attribute:"patch_publication_date", value:"2015/03/26");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/15");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch");
script_set_attribute(attribute:"generated_plugin", value:"former");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Tenable.ot");
script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tenable_ot_api_integration.nasl");
script_require_keys("Tenable.ot/Rockwell");
exit(0);
}
include('tenable_ot_cve_funcs.inc');
get_kb_item_or_exit('Tenable.ot/Rockwell');
var asset = tenable_ot::assets::get(vendor:'Rockwell');
var vuln_cpes = {
"cpe:/h:rockwellautomation:allen-bradley_stratix_5900_industrial_managed_ethernet_switch" :
{"versionEndExcluding" : "15.6.3", "family" : "Stratix"}
};
tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);