ConnectWise ScreenConnect < 26.6.5 Missing Authorization

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344805);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");

  script_cve_id("CVE-2026-84869");
  script_xref(name:"IAVB", value:"2026-B-0254");

  script_name(english:"ConnectWise ScreenConnect < 26.6.5 Missing Authorization");

  script_set_attribute(attribute:"synopsis", value:
"A remote access application installed on the remote host is affected by a missing authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its version, the ConnectWise ScreenConnect remote access software installed on the remote host is prior to
26.6.5. It is, therefore, affected by a missing authorization vulnerability:

  - A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote
    session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not
    impacted. (CVE-2026-84869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2395c618");
  # https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?abf169f8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ConnectWise ScreenConnect version 26.6.5 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84869");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:connectwise:screenconnect");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("connectwise_screenconnect_win_installed.nbin", "connectwise_screenconnect_nix_installed.nbin");
  script_require_keys("installed_sw/ConnectWise ScreenConnect");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'ConnectWise ScreenConnect', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [ {'fixed_version': '26.6.5'} ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);