Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329329);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2026-10714");
  script_xref(name:"IAVA", value:"2026-B-0200");

  script_name(english:"Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rockwell FactoryTalk Services Platform installed on the remote Windows host is 6.60. It is, therefore,
affected by an authentication bypass vulnerability:

  - A vulnerability exists that allows an attacker to bypass JWT signature validation during Okta Web Authentication.
    The application does not verify that the JWT algorithm is configured for RSA, enabling an attacker to set the
    algorithm to 'none' and craft forged tokens. This could allow an authenticated low-privilege user to impersonate
    any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to
    grant permissions to other systems protected by FTSP. (CVE-2026-10714)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number. The fix for this vulnerability is a patch applied to an existing version, which Nessus is unable to detect.");
  # https://www.rockwellautomation.com/en-in/trust-center/security-advisories/advisory.SD1786.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4fcac294");
  script_set_attribute(attribute:"solution", value:
"Apply patch RAID 1158263 or refer to vendor advisory SD1786.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-10714");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:factorytalk_services_platform");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SCADA");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rockwell_factorytalk_services_platform_win_installed.nbin");
  script_require_keys("installed_sw/Rockwell FactoryTalk Services Platform", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Rockwell FactoryTalk Services Platform', win_local:TRUE);

var constraints = [
  {'equal': '6.60', 'fixed_display': 'Apply patch RAID 1158263 (see vendor advisory SD1786)', 'require_paranoia': TRUE}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);