WAGO Series 750-88x and 750-87x Use of Hard-Coded Credentials (CVE-2019-10712)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(500836);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2019-10712");

  script_name(english:"WAGO Series 750-88x and 750-87x Use of Hard-Coded Credentials (CVE-2019-10712)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829,
750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885,
750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872,
750-873) devices has undocumented service access.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?048bd3b9");
  script_set_attribute(attribute:"see_also", value:"https://cert.vde.com/de-de/advisories/vde-2019-008");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/108482");
  # https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51f00a97");
  # https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f90ce40");
  # https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b6042853");
  # https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c8257f55");
  # https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?18314046");
  # https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1cc44fa1");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-19-106-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

WAGO released a security advisory available at:https://www.wago.com/de/download/public/Sicherheitshinweis-SA-
SYS-2019-001/SA-SYS-2019-001.pdf

WAGO recommends updating to the newest firmware as listed above and taking the following defensive measures:

- Restrict network access to the web server.
- Restrict network access to the device.
- Do not directly connect the device to the Internet.

CERT@VDE has published an advisory regarding this vulnerability at the following location:

https://cert.vde.com/en-us/advisories/vde-2019-008");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-10712");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(798);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/02/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-330_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-352_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-829_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-830_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-831_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-849_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-852_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-871_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-872_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-873_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-880_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-881_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-882_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-884_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-885_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:wago:750-889_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Wago");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Wago');

var asset = tenable_ot::assets::get(vendor:'Wago');

var vuln_cpes = {
    "cpe:/o:wago:750-830_firmware" :
        {"versionEndExcluding" : "06", "family" : "Controller750"},
    "cpe:/o:wago:750-849_firmware" :
        {"versionEndExcluding" : "08", "family" : "Controller750"},
    "cpe:/o:wago:750-871_firmware" :
        {"versionEndExcluding" : "11", "family" : "Controller750"},
    "cpe:/o:wago:750-872_firmware" :
        {"versionEndExcluding" : "07", "family" : "Controller750"},
    "cpe:/o:wago:750-873_firmware" :
        {"versionEndExcluding" : "07", "family" : "Controller750"},
    "cpe:/o:wago:750-330_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-352_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-829_firmware" :
        {"versionEndExcluding" : "14", "family" : "ControllerPFC200"},
    "cpe:/o:wago:750-831_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-852_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-880_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-881_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-882_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-884_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-885_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"},
    "cpe:/o:wago:750-889_firmware" :
        {"versionEndExcluding" : "14", "family" : "Controller750"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);