Siemens SICAM A8000 Use of Hard-Coded Credentials (CVE-2021-45033)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501075);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2021-45033");

  script_name(english:"Siemens SICAM A8000 Use of Hard-Coded Credentials (CVE-2021-45033)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O
-25/+70C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O
-40/+70C (All versions < V16.20), CP-8021 MASTER MODULE (All versions
< V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An
undocumented debug port uses hard-coded default credentials. If this
port is enabled by a privileged user, an attacker aware of the
credentials could access an administrative debug shell on the affected
device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-013-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends updating to v16.20 or later.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. To operate the devices in a protected IT environment, Siemens recommends users configure the environment
according to Siemens’ operational guidelines for Industrial Security and follow the recommendations in the product
manuals.

Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

For more information about these vulnerabilities, see Siemens’ security advisory SSA-324998");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-45033");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(798);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/04/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-25%2f%2b70_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-40%2f%2b70_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8021_master_module_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:cp-8022_master_module_with_gprs_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-25%2f%2b70_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP800"},
    "cpe:/o:siemens:cp-8000_master_module_with_i%2fo_-40%2f%2b70_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP800"},
    "cpe:/o:siemens:cp-8021_master_module_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP802"},
    "cpe:/o:siemens:cp-8022_master_module_with_gprs_firmware" :
        {"versionEndExcluding" : "16.20", "family" : "SicamA8000CP802"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);