Siemens SCALANCE Products Improper Adherence to Coding Standards (CVE-2019-10928)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501061);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2019-10928");

  script_name(english:"Siemens SCALANCE Products Improper Adherence to Coding Standards (CVE-2019-10928)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in SCALANCE SC-600 (V2.0). An
authenticated attacker with access to port 22/tcp as well as physical
access to an affected device may trigger the device to allow execution
of arbitrary commands. The security vulnerability could be exploited
by an authenticated attacker with physical access to the affected
device. No user interaction is required to exploit this vulnerability.
The vulnerability impacts the confidentiality, integrity and
availability of the affected device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-19-227-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens currently has an update for the following product:

- SCALANCE SC-600: Update to v2.0.1

- SCALANCE XB-200: Update to v4.2
- SCALANCE XC-200: Update to v4.2
- SCALANCE XF-200BA: Update to v4.2
- SCALANCE XP-200: Update to v4.2
- SCALANCE XR-300WG: Update to v4.2

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce risk: 

- Restrict access to Port 22/TCP (use the built-in firewall for SCALANCE SC-600); 
- Restrict physical access to the device.

As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the
environment according to Siemens’ operational guidelines for Industrial Security, and following the recommendations in
the product manuals.

Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens
ProductCERT: https://www.siemens.com/cert/advisories

For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens security
advisory SSA-671286 at the following location: http://www.siemens.com/cert/advisories");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-10928");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/04/11");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_sc-600_series_firmware:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_sc-600_series_firmware:2.0" :
        {"versionEndIncluding" : "2.0", "versionStartIncluding" : "2.0", "family" : "SCALANCES"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);