Rockwell Studio 5000 Logix Designer Unquoted Search Path (SD1783)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(327599);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2026-9128");

  script_name(english:"Rockwell Studio 5000 Logix Designer Unquoted Search Path (SD1783)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by a code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a code execution
vulnerability. An unquoted search path in the External Tools configuration means that executable paths containing spaces
are not properly quoted, so the operating system may resolve them to unintended executables placed earlier in the search
order. An attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code
execution with the same permissions as the user running the application. (CVE-2026-9128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d53c0ce7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rockwell Studio 5000 Logix Designer version 32.05, 33.03, 34.03, 35.01, or 36.00 (as applicable to the
installed release branch), or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9128");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:studio_5000_logix_designer");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SCADA");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rockwell_studio_5000_logix_designer_win_installed.nbin");
  script_require_keys("installed_sw/Rockwell Studio 5000 Logix Designer");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Rockwell Studio 5000 Logix Designer', 'type': 'app'},
      'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}}
      ],
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '32.05', 'fixed_display': 'V32.05'},
        {'min_version': '33.00', 'fixed_version': '33.03', 'fixed_display': 'V33.03'},
        {'min_version': '34.00', 'fixed_version': '34.03', 'fixed_display': 'V34.03'},
        {'min_version': '35.00', 'fixed_version': '35.01', 'fixed_display': 'V35.01'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);