cve_2023_20198_cisco_ios_xe

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# Filename: cve_2023_20198_cisco_ios_xe.py
# Version: 1.0.0
# Author: Jeoi Reqi
# Vulnerability Source: https://nvd.nist.gov/vuln/detail/CVE-2023-20198

"""
Description:
This script checks for the presence of vulnerable software configurations on the user's machine
in relation to the CVE-2023-20198 vulnerability. It compares the list of installed software on
the system with a predefined list of vulnerable software configurations associated with the CVE.
If any vulnerable software configurations are found, it displays a warning message to prompt
the user to take immediate action to mitigate the vulnerability.

Requirements:
- Python 3.x: The script is written in Python 3 and requires a Python interpreter of version 3 or higher to run.
- WMI Module: The script uses the WMI module to interact with the Windows Management Instrumentation (WMI) API
  to retrieve a list of installed software on a Windows system. Ensure that the WMI module is installed.
  You can install it using pip: `pip install WMI`.

Usage:
1. Ensure Python 3.x is installed on your system.
2. Install the WMI module by running `pip install WMI`.
3. Run the script using the command `python cve_2023_20198.py`.
4. The script will verify if any vulnerable software configurations are installed on your machine and
   provide instructions for mitigation if necessary.

Functions:
- get_installed_software(): Retrieves a list of installed software on the user's machine using the WMI module.
- check_for_vulnerabilities(): Compares the list of installed software with a predefined list of vulnerable
  software configurations and displays a warning message if any vulnerable software configurations are found.

Important Notes:
- The predefined list of vulnerable software configurations in this script corresponds to the CVE-2023-20198 vulnerability.
- The script only supports Windows systems due to its dependency on the WMI module for retrieving installed software information.
"""

import wmi

# List of vulnerable software configurations
vulnerable_software = [
    "Cisco IOS XE 16.12",
    "Cisco IOS XE 17.3",
    "Cisco IOS XE 17.6",
    "Cisco IOS XE 17.9"
]

def get_installed_software():
    """
    Retrieves a list of installed software on the user's machine using the WMI module.

    Returns:
        list: A list containing the names of installed software.
    """
    c = wmi.WMI()
    installed_software = []
    for item in c.Win32_Product():
        installed_software.append(item.Caption)
    return installed_software

def check_for_vulnerabilities():
    """
    Compares the list of installed software with a predefined list of vulnerable software configurations
    and displays a warning message if any vulnerable software configurations are found.
    """
    installed_software = get_installed_software()
    vulnerable_installed = [software for software in installed_software if software in vulnerable_software]
    if vulnerable_installed:
        print("\nWarning:\nThe following vulnerable software configurations are installed on your machine:")
        for software in vulnerable_installed:
            print("- " + software)
        print("\nPlease take immediate action to verify compliance with BOD 23-02 & apply mitigations per vendor instructions.\nFor affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks):\nfollow vendor instructions to determine if a system may have been compromised & immediately report positive findings to CISA.\n")
    else:
        print("\nAll clear!\nNone of the vulnerable software configurations are installed on your machine.\n")

if __name__ == "__main__":
    print("Verifying vulnerable software configurations...")
    check_for_vulnerabilities()