Siemens RUGGEDCOM ROX Improper Neutralization of Special Elements Used in a Command (CVE-2022-29560)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501627);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");

  script_cve_id("CVE-2022-29560");
  script_xref(name:"ICSA", value:"22-195-05");

  script_name(english:"Siemens RUGGEDCOM ROX Improper Neutralization of Special Elements Used in a Command (CVE-2022-29560)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All
versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1),
RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500
(All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions < 2.15.1),
RUGGEDCOM ROX RX1510 (All versions < 2.15.1), RUGGEDCOM ROX RX1511
(All versions < 2.15.1), RUGGEDCOM ROX RX1512 (All versions < 2.15.1),
RUGGEDCOM ROX RX1524 (All versions < 2.15.1), RUGGEDCOM ROX RX1536
(All versions < 2.15.1), RUGGEDCOM ROX RX5000 (All versions < 2.15.1).
Affected devices do not properly validate user input, making them
susceptible to command injection. An attacker with access to either
the shell or the web CLI with administrator privileges could access
the underlying operating system as the root user.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-599506.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-05");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends updating RUGGEDCOM ROX devices to the latest version:

- RUGGEDCOM ROX MX and RX family devices: Update to v2.15.1 or later

Siemens has identified the following specific workarounds and mitigations customers can apply to reduce risk:

- Apply the principle of least privileges for accounts configured on the affected devices.
- Apply defense-in-depth practices to the SSH, Web and NETCONF services on ROX.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends users configure the environment according to the
Siemens operational guidelines for industrial security and follow the recommendations in the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-599506");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-29560");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/07/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/09/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_mx5000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_mx5000re_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1400_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1500_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1501_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1510_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1511_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1512_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1524_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1536_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx5000_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rox_rx1500_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1501_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1510_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1511_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1512_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1524_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1536_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx5000_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1400_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_mx5000re_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_mx5000_firmware" :
        {"versionEndExcluding" : "2.15.1", "family" : "RuggedCom"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);