Cleanup os and hw params for CPE updates

rapid7 · Nov 18, 2021 · 1a97829 · 1a97829
1 parent 968cc8c
commit 1a97829
Show file tree

Hide file tree

Showing 8 changed files with 35 additions and 16 deletions.
diff --git a/cpe-remap.yaml b/cpe-remap.yaml
@@ -140,6 +140,8 @@ mappings:
     parallels:
       products:
         plesk: parallels_plesk_panel
+    phoenix_contact:
+      vendor: phoenixcontact
     plesk:
       vendor: parallels
     proftpd_project:
@@ -208,6 +210,7 @@ mappings:
     apple:
       products:
         ios: iphone_os
+        mac_os: macos
     brocade:
       vendor: broadcom
       products:
@@ -277,10 +280,14 @@ mappings:
         ilom: integrated_lights_out_manager_firmware
     palo_alto_networks:
       vendor: paloaltonetworks
+    phoenix_contact:
+      vendor: phoenixcontact
     red_hat:
       vendor: redhat
       products:
         fedora_core_linux: fedora_core
+    software_house:
+      vendor: swhouse
     sun:
       products:
         solaris: sunos
@@ -337,6 +344,10 @@ mappings:
       vendor: dell
       products:
         k1000: kace_k1000_systems_management_appliance
+    phoenix_contact:
+      vendor: phoenixcontact
+    software_house:
+      vendor: swhouse
     tandberg:
       vendor: cisco
     ubiquiti:

diff --git a/identifiers/hw_family.txt b/identifiers/hw_family.txt
@@ -116,5 +116,6 @@ iPad Pro
 iPad mini
 iPhone
 iPod
+iSTAR Door Controllers
 imageClass
 imageRunner
diff --git a/identifiers/hw_product.txt b/identifiers/hw_product.txt
@@ -457,4 +457,5 @@ iPod Touch (4th generation)
 iPod Touch (5th generation)
 iPod Touch (6th generation)
 iPod Touch (7th generation)
+iSTAR Ultra
 vManage
diff --git a/identifiers/os_product.txt b/identifiers/os_product.txt
@@ -269,6 +269,7 @@ USG40 firmware
 USG60 firmware
 Ubuntu Linux
 Ultrix
+Unified SIP Phone 3900 Firmware
 UnixWare
 VBrick Rev
 VIDOS-NVR

diff --git a/identifiers/vendor.txt b/identifiers/vendor.txt
@@ -663,6 +663,7 @@ SmoothWall
 SnapServer
 Sofrel
 Softing
+Software House
 SolarWinds
 SonarQube
 SonicWall

diff --git a/xml/favicons.xml b/xml/favicons.xml
@@ -1852,11 +1852,13 @@
   <fingerprint pattern="^c7f62c79333a43b6cd3f24d9e9c69526$">
     <description>iSTAR Ultra</description>
     <example>c7f62c79333a43b6cd3f24d9e9c69526</example>
-    <param pos="0" name="os.vendor" value="iStar"/>
-    <param pos="0" name="os.product" value="Linux"/>
-    <param pos="0" name="hw.vendor" value="iStar"/>
+    <param pos="0" name="os.vendor" value="Software House"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="hw.vendor" value="Software House"/>
     <param pos="0" name="hw.device" value="Access Control"/>
-    <param pos="0" name="hw.product" value="Ultra Door Controller"/>
+    <param pos="0" name="hw.family" value="iSTAR Door Controllers"/>
+    <param pos="0" name="hw.product" value="iSTAR Ultra"/>
   </fingerprint>
 
   <fingerprint pattern="^fc83221e4a9e57f2e0b10416de541ca3|e518c347f94a594de49e3f3948b8e6e5$">

diff --git a/xml/sip_user_agents.xml b/xml/sip_user_agents.xml
@@ -129,15 +129,15 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
   </fingerprint>
 
-  <fingerprint pattern="^Cisco-CP(\d{4})/([\d.]+)$">
-    <description>Cisco CP-model IP Phones</description>
-    <example cisco.model="3905" hw.product="CP-3905" os.version="9.4.1">Cisco-CP3905/9.4.1</example>
+  <fingerprint pattern="^Cisco-CP(39\d{2})/([\d.]+)$">
+    <description>Cisco Unified SIP Phone 3900 Series</description>
+    <example cisco.model="3905" hw.product="Unified SIP Phone 3905" os.version="9.4.1">Cisco-CP3905/9.4.1</example>
     <param pos="1" name="cisco.model"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>
     <param pos="0" name="hw.device" value="VoIP"/>
-    <param pos="0" name="hw.product" value="CP-{cisco.model}"/>
+    <param pos="0" name="hw.product" value="Unified SIP Phone {cisco.model}"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
-    <param pos="0" name="os.product" value="IOS"/>
+    <param pos="0" name="os.product" value="Unified SIP Phone 3900 Firmware"/>
     <param pos="2" name="os.version"/>
     <param pos="0" name="hw.certainty" value="0.95"/>
     <param pos="0" name="os.certainty" value="0.95"/>
@@ -146,13 +146,13 @@
 
   <fingerprint pattern="^Cisco-ATA(\d{3})/([\d.]+)$">
     <description>Cisco Analog Telephone Adapters (ATA)</description>
-    <example cisco.model="187" hw.product="ATA-187" os.version="9.2.3">Cisco-ATA187/9.2.3</example>
+    <example cisco.model="187" hw.product="ATA 187" os.version="9.2.3">Cisco-ATA187/9.2.3</example>
     <param pos="1" name="cisco.model"/>
     <param pos="0" name="hw.vendor" value="Cisco"/>
     <param pos="0" name="hw.device" value="VoIP"/>
-    <param pos="0" name="hw.product" value="ATA-{cisco.model}"/>
+    <param pos="0" name="hw.product" value="ATA {cisco.model}"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
-    <param pos="0" name="os.product" value="IOS"/>
+    <param pos="0" name="os.product" value="ATA {cisco.model} Firmware"/>
     <param pos="2" name="os.version"/>
     <param pos="0" name="hw.certainty" value="0.9"/>
     <param pos="0" name="os.certainty" value="0.9"/>

diff --git a/xml/x509_subjects.xml b/xml/x509_subjects.xml
@@ -1688,11 +1688,13 @@
   <fingerprint pattern="^CN=iSTAR Ultra">
     <description>iSTAR Ultra</description>
     <example>CN=iSTAR Ultra,OU=Access Control and Video Division,O=Johnson Controls,L=Westford,ST=Massachusetts,C=US</example>
-    <param pos="0" name="os.vendor" value="iStar"/>
-    <param pos="0" name="os.product" value="Linux"/>
-    <param pos="0" name="hw.vendor" value="iStar"/>
+    <param pos="0" name="os.vendor" value="Software House"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="hw.vendor" value="Software House"/>
     <param pos="0" name="hw.device" value="Access Control"/>
-    <param pos="0" name="hw.product" value="Ultra Door Controller"/>
+    <param pos="0" name="hw.family" value="iSTAR Door Controllers"/>
+    <param pos="0" name="hw.product" value="iSTAR Ultra"/>
   </fingerprint>
 
   <fingerprint pattern="^O=SpotteRF - NetworkedIO$">