Rockwell Automation MicroLogix Improper Authentication (CVE-2017-12088)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500206);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2017-12088");
  script_xref(name:"ICSA", value:"18-095-01");

  script_name(english:"Rockwell Automation MicroLogix Improper Authentication (CVE-2017-12088)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400
Series B FRN 21.2 and below. A specially crafted packet can cause a device power cycle resulting in a fault state and
deletion of ladder logic. An attacker can send one unauthenticated packet to trigger this vulnerability  

This plugin
only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0440
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?330019c6");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-18-095-01");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN1015.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9d68ca89");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has recommended that users employ the following mitigation strategies where applicable:

- Users using affected versions of MicroLogix 1100 and MicroLogix 1400 Series A are urged to contact their local
distributor or Sales Office in order to upgrade their devices to a newer product line.
- Set keyswitch to Hard Run to block any unauthorized changes
- For MicroLogix 1400 Series only, Apply FRN 21.002 or later

Rockwell Automation has provided more specific mitigations that can be found in their customer notification (KB1072942)
located at:

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1072942# (login required)");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12088");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micrologix_1400_b_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:micrologix_1400_b_firmware" :
        {"versionEndIncluding" : "21.2", "family" : "MicroLogix1400"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);