Rockwell Studio 5000 Logix Designer Path Traversal (SD1783)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(327601);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2026-9108");

  script_name(english:"Rockwell Studio 5000 Logix Designer Path Traversal (SD1783)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a path
traversal vulnerability. The software does not sanitize or validate file names embedded in the ACD file structure
during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory.
An attacker could craft a malicious ACD project file that results in arbitrary files being written to
attacker-controlled locations on the file system, potentially leading to code execution. (CVE-2026-9108)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d53c0ce7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rockwell Studio 5000 Logix Designer version 32.05, 33.04, 34.04, 35.02, 36.01, or 37.00 (as applicable to
the installed release branch), or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9108");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:studio_5000_logix_designer");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SCADA");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rockwell_studio_5000_logix_designer_win_installed.nbin");
  script_require_keys("installed_sw/Rockwell Studio 5000 Logix Designer");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Rockwell Studio 5000 Logix Designer', 'type': 'app'},
      'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}}
      ],
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '32.05', 'fixed_display': 'V32.05'},
        {'min_version': '33.00', 'fixed_version': '33.04', 'fixed_display': 'V33.04'},
        {'min_version': '34.00', 'fixed_version': '34.04', 'fixed_display': 'V34.04'},
        {'min_version': '35.00', 'fixed_version': '35.02', 'fixed_display': 'V35.02'},
        {'min_version': '36.00', 'fixed_version': '36.01', 'fixed_display': 'V36.01'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);