Siemens SCALANCE X-300 Switches Stack-Based Buffer Overflow (CVE-2022-25753)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500758);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2022-25753");

  script_name(english:"Siemens SCALANCE X-300 Switches Stack-Based Buffer Overflow (CVE-2022-25753)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in SCALANCE X302-7 EEC (230V),
SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V),
SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V),
SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V),
SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE
X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V,
coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated),
SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated),
SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated),
SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE
X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD,
SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE
X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M,
SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS,
SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE,
SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE
X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M
(230V, ports on front), SCALANCE XR324-12M (230V, ports on rear),
SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V,
ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE
XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on
rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V),
SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE
XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M
EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC
(100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V,
ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE
XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports
on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on
rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear),
SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC
(2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on
rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE
XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V,
ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE
XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V,
ports on front), SIPLUS NET SCALANCE X308-2. The handling of arguments
such as IP addresses in the CLI of affected devices is prone to buffer
overflows. This could allow an authenticated remote attacker to
execute arbitrary code on the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-09");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends upgrading all X-300 switch family devices to v4.1.4 or later.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:

- Restrict access to the affected systems, especially to Ports 22/TCP, 161/UDP, and 443/TCP and use trusted IP addresses
only.
- Disable SNMP service, if possible.
- Deactivate the webserver if not required, and if deactivation is supported by the product.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the
environment according to the Siemens operational guidelines for industrial security and follow the recommendations in
the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-836527");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-25753");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/01/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x302-7eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x304-2fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x306-1ldfe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-2eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-3_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x307-3ld_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2ld_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2lh%2b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2lh_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x308-2m_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x310_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x310fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x320-1-2ldfe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x320-1fe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_x408-2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-12m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-12m_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_eec_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_poe_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr324-4m_poe_ts_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_net_scalance_x308-2_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_x302-7eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x304-2fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x306-1ldfe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-2eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-3_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x307-3ld_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2ld_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2lh_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2lh%2b_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2m_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x308-2m_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x310_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x310fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x320-1fe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x320-1-2ldfe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_x408-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr324-4m_eec_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-4m_poe_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-4m_poe_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-12m_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr324-12m_ts_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:siplus_net_scalance_x308-2_firmware" :
        {"versionEndExcluding" : "4.1.4", "family" : "SCALANCEX300"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);