Rockwell Automation Logix Controllers Insufficiently Protected Credentials (CVE-2021-22681)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500451);
  script_version("1.13");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2021-22681");
  script_xref(name:"ICSA", value:"21-056-03");

  script_name(english:"Rockwell Automation Logix Controllers Insufficiently Protected Credentials (CVE-2021-22681)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key
to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480:
ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570,
5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16
through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate
with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix
5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.  

This plugin only works
with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03");
  script_set_attribute(attribute:"see_also", value:"https://www.rockwellautomation.com/en-us/support/advisory.PN1550.html");
  # https://claroty.com/team82/research/critical-authentication-bypass-in-rockwell-software
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8402eb8");
  # https://www.rockwellautomation.com/en-us/support/advisory.PN1550.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?46bc36f8");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has determined this vulnerability cannot be mitigated with a patch. Rockwell encourages users to
combine its specific risk mitigation recommendations with general security guidelines for a comprehensive defense-in-
depth strategy.

A comprehensive defense-in-depth strategy can reduce the risk of this vulnerability. To reduce risk, Rockwell recommends
users ensure they are employing proper network segmentation and security controls; including, but not limited to:

- Minimizing network exposure for all control system devices and/or systems and confirm these devices are not accessible
from the Internet.
- Locating control system networks and devices behind firewalls and isolating them from the enterprise/business network.
- Restricting or blocking traffic on TCP 44818 from outside of the industrial control system network zone. For more
information on the TCP/UDP ports used by Rockwell Automation products, see BF7490 (login required).
- When remote access is required, use secure methods such as virtual private networks (VPNs), recognizing VPNs may have
vulnerabilities and should be updated to the most current version available. VPN is only as secure as the connected
devices.

Users should refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices for
deploying network segmentation, as well as broader defense-in-depth strategies. Users can also refer to Rockwell
Automation’s System Security Design Guidelines on how to use Rockwell Automation products to improve the security of
industrial automation systems.

Common Industrial Protocol (CIP) Security mitigates this vulnerability as it provides the ability to deploy TLS- and
DTLS-based secure communications to supported products. CIP Security is an enhancement to the ODVA (Open DeviceNet
Vendors Association) EtherNet/IP industrial communication standard and directly addresses this vulnerability. CIP
Security allows users to leverage and manage certificates and/or pre-shared keys, and does not make use of any hardcoded
keys.

Users requiring setup or deployment guidance for CIP Security protocol should refer to the CIP Security deployment
reference guide.

Additionally, Rockwell recommends users follow the following risk mitigation and recommended user actions for the
following product family and versions:

- ControlLogix 5580 v32 or later: 
    - Put controller’s mode switch to “Run” mode.
    - If the above cannot be deployed, the followings mitigations are recommended: 
        - Deploy CIP Security for Logix Designer connections through the front port. CIP Security prevents unauthorized
connection when deployed properly.
        - If not using the front port, use a 1756-EN4TR ControlLogix Ethernet/IP Module and deploy CIP Security. The
1756-EN4TR supports CIP Security which prevents unauthorized connections when properly deployed.
- ControlLogix 5580 v31: 
    - Put controller’s mode switch to “Run” mode.
    - If the above cannot be deployed, the following mitigations are recommended: 
        - Apply v32 or later and follow mitigations actions outlined above.
        - If unable to apply a newer version, use a 1756-EN4TR ControlLogix EtherNet/IP Module and deploy CIP Security.
The 1756-EN4TR supports CIP Security, which prevents unauthorized connections when properly deployed.
- ControlLogix 5570 v31 or later: 
    - Put controller’s mode switch to “Run” mode.
    - If the above cannot be deployed, the following mitigations are recommended: 
        - Use a 1756-EN4TR ControlLogix EtherNet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP
Security, which prevents unauthorized connections when properly deployed.
- ControlLogix 5580 v28-v30, ControlLogix 5570 v18 or later, ControlLogix 5560 v16 or later, ControlLogix 5550 v16,
GuardLogix 5580 v31 or later, GuardLogix 5570 v20 or later, GuardLogix 5560 v16 or later, 1768 CompactLogix v16 or
later, 1769 CompactLogix v16 or later, CompactLogix 5370 v20 or later, CompactLogix 5380 v28 or later, CompactLogix 5480
v32 or later, Compact GuardLogix 5370 v28 or later, Compact GuardLogix 5380 v31 or later, FlexLogix 1794-L34 v16,
DriveLogix 5370 v16 or later.
    - Put controller’s mode switch to “Run” mode.
- SoftLogix 5800: No additional mitigation available. Follow the Converged Plantwide Ethernet (CPwE) Design and
Implementation Guide.

In addition, Rockwell recommends users employ the following methods to detect changes to configuration or application
files:

- Monitor controller change log for any unexpected modifications or anomalous activity.
- If using v17 or later, utilize the Controller Log feature.
- If using v20 or later, utilize Change Detection in the Logix Designer Application.
- If available, use the functionality in Factory Talk AssetCentre to detect changes.

Rockwell Automation has published a security advisory that further describes how this vulnerability affects the Studio
5000 Logix Designer software and associated controllers.

Requests for additional information can be sent to the Rockwell RASecure Inbox ([email protected]).");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-22681");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(522);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/03/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/03/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compact_guardlogix_5370");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1768");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_1769");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_5370");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_5380");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:compactlogix_5480");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:controllogix_5550");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:controllogix_5560");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:controllogix_5570");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:controllogix_5580");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:flexlogix_1794-l34");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:drivelogix_1794-l34");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:guardlogix_5570");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:softlogix_5800");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/h:rockwellautomation:compact_guardlogix_5370" :
        {"versionStartIncluding" : "28", "family" : "GuardLogix5370"},
    "cpe:/h:rockwellautomation:compactlogix_1768" :
        {"versionStartIncluding" : "16", "family" : "CompactLogix"},
    "cpe:/h:rockwellautomation:compactlogix_1769" :
        {"versionStartIncluding" : "16", "family" : "CompactLogix"},
    "cpe:/h:rockwellautomation:compactlogix_5370" :
        {"versionStartIncluding" : "20", "family" : "CompactLogix5370"},
    "cpe:/h:rockwellautomation:compactlogix_5380" :
        {"versionStartIncluding" : "28", "family" : "CompactLogix5380"},
    "cpe:/h:rockwellautomation:compactlogix_5480" :
        {"versionStartIncluding" : "32", "family" : "CompactLogix5480"},
    "cpe:/h:rockwellautomation:controllogix_5550" :
        {"versionStartIncluding" : "16", "family" : "ControlLogix5550"},
    "cpe:/h:rockwellautomation:controllogix_5560" :
        {"versionStartIncluding" : "16", "family" : "ControlLogix5560"},
    "cpe:/h:rockwellautomation:controllogix_5570" :
        {"versionStartIncluding" : "31", "family" : "ControlLogix5570"},
    "cpe:/h:rockwellautomation:controllogix_5580" :
        {"versionStartIncluding" : "28", "family" : "ControlLogix5580"},
    "cpe:/h:rockwellautomation:flexlogix_1794-l34" :
        {"versionStartIncluding" : "16", "family" : "FlexLogix"},
    "cpe:/h:rockwellautomation:drivelogix_1794-l34" :
        {"versionStartIncluding" : "16", "family" : "FlexLogix"},
    "cpe:/h:rockwellautomation:guardlogix_5570" :
        {"versionStartIncluding" : "18", "family" : "GuardLogix5570"},
    "cpe:/h:rockwellautomation:softlogix_5800" :
        {"family" : "SoftLogix5800"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);