An unsecured configuration interface on affected devices

#!/usr/bin/env python3
"""CVE-2026-3323 checker for VEGA VEGAPULS 6X (Ethernet-APL / PROFINET / Modbus TCP variants).
Reads firmware version via Modbus TCP Device Identification and compares to patched version 1.1.1.
Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
"""
import sys

try:
    from pymodbus.client import ModbusTcpClient
    from pymodbus.mei_message import ReadDeviceInformationRequest
except ImportError:
    print("UNKNOWN - pymodbus not installed. Run: pip install pymodbus>=3.0")
    sys.exit(2)

try:
    from packaging.version import Version
except ImportError:
    print("UNKNOWN - packaging not installed. Run: pip install packaging")
    sys.exit(2)

PATCHED = "1.1.1"
PORT = 502
TIMEOUT = 5

def main():
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <VEGAPULS_6X_IP>")
        sys.exit(2)
    host = sys.argv[1]
    client = ModbusTcpClient(host, port=PORT, timeout=TIMEOUT)
    if not client.connect():
        print(f"UNKNOWN - cannot connect to {host}:{PORT}")
        sys.exit(2)
    fw = None
    try:
        # Method 1: Modbus Device Identification (FC 43 / MEI 14), object 0x02 = firmware revision
        resp = client.execute(ReadDeviceInformationRequest(read_code=0x01, unit=1))
        if resp and not resp.isError() and hasattr(resp, 'information'):
            raw = resp.information.get(0x02, b'')
            fw = raw.decode('ascii', errors='ignore').strip('\x00').strip() if raw else None
        # Method 2: fallback to holding register block where VEGA stores version string
        if not fw:
            rr = client.read_holding_registers(address=0x0040, count=4, slave=1)
            if rr and not rr.isError():
                buf = b''.join(r.to_bytes(2, 'big') for r in rr.registers)
                fw = buf.decode('ascii', errors='ignore').strip('\x00').strip()
    except Exception as exc:
        print(f"UNKNOWN - error querying {host}: {exc}")
        sys.exit(2)
    finally:
        client.close()
    if not fw:
        print(f"UNKNOWN - could not read firmware version from {host}")
        sys.exit(2)
    try:
        ver = Version(fw)
    except Exception:
        print(f"UNKNOWN - cannot parse firmware string '{fw}' from {host}")
        sys.exit(2)
    if ver >= Version(PATCHED):
        print(f"PATCHED - {host} firmware {fw} (>= {PATCHED})")
        sys.exit(0)
    else:
        print(f"VULNERABLE - {host} firmware {fw} (< {PATCHED}) -- CVE-2026-3323")
        sys.exit(1)

if __name__ == '__main__':
    main()