Siemens Industrial PCs and CNC devices Improper Privilege Management (CVE-2020-8745)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500702);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/09");

  script_cve_id("CVE-2020-8745");

  script_name(english:"Siemens Industrial PCs and CNC devices Improper Privilege Management (CVE-2020-8745)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80,
12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an
unauthenticated user to potentially enable escalation of privilege via physical access.

  - Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80,
    11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30
    may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
    (CVE-2020-8745)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0627cbb");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20201113-0005/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-05");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20201113-0002/");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has released updates for several affected products and is currently working on BIOS updates that include chipset
microcode updates for further products.

- SIMATIC Drive Controller family: Update BIOS to v05.00.01.00. The update can be obtained from a Siemens account
manager
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update BIOS to v0209_0105 or later versions
- SIMATIC Field PG M5: Update BIOS to v22.01.08

- SIMATIC Field PG M6: Update BIOS to v26.01.08 or later version

- SIMATIC IPC127E: Update BIOS to v27.01.05
- SIMATIC IPC427E (incl. SIPLUS variants): Update BIOS to v21.01.15
- SIMATIC IPC477E: Update BIOS to v21.01.15
- SIMATIC IPC477E Pro: Update BIOS to v21.01.15
- SIMATIC IPC527G: Update BIOS to v1.4.0
- SIMATIC IPC547G: Update BIOS to R1.30.0
- SIMATIC IPC627E: Update BIOS to v25.02.08
- SIMATIC IPC647E: Update BIOS to v25.02.08
- SIMATIC IPC677E: Update BIOS to v25.02.08
- SIMATIC IPC847E: Update BIOS to v25.02.08
- SIMATIC ITP1000: Update BIOS to v23.01.08
- SINUMERIK 828D HW PU.4: Update BIOS to v08.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK MC MCU 1720: Update BIOS to v05.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE NCU 1740: Update BIOS to v04.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE PPU 1740: Update BIOS to v06.00.00.00. SINUMERIK software can be obtained from a Siemens account manager

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- Siemens recommends limiting the possibilities to run untrusted code.
- Siemens recommends applying the defense-in-depth concept to reduce the probability for untrusted code to run on the
system.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see Siemens Security Advisory SSA-678983");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-8745");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/11/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/10/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et200sp_1515sp_pc2_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_et200sp_1515sp_pc2_firmware" :
        {"versionEndExcluding" : "0209.0105", "family" : "ET200SP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);