Autodesk Installer Privilege Escalation (CVE-2025-10885)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275460);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/16");

  script_cve_id("CVE-2025-10885");
  script_xref(name:"IAVA", value:"2025-A-0830");

  script_name(english:"Autodesk Installer Privilege Escalation (CVE-2025-10885)");

  script_set_attribute(attribute:"synopsis", value:
"A software component installed on the remote Windows host is affected by a privilege escalation.");
  script_set_attribute(attribute:"description", value:
"This vulnerability is a privilege escalation flaw in the Autodesk Installer, where improper validation of files 
loaded during the installation process allows a local, low-privileged attacker to craft a malicious file that is 
executed with elevated permissions, ultimately enabling arbitrary code execution as NT AUTHORITY\SYSTEM and full 
compromise of the host system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0022");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Autodesk Installer 2.19 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-10885");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:autodesk:installer");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("autodesk_installer_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Autodesk Installer");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Autodesk Installer', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'2.0', 'fixed_version': '2.19'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);