Rockwell Automation ThinManager ThinServer Path Traversal (SD1782)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329330);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2026-11917");
  script_xref(name:"IAVA", value:"2026-B-0200");

  script_name(english:"Rockwell Automation ThinManager ThinServer Path Traversal (SD1782)");

  script_set_attribute(attribute:"synopsis", value:
"The Rockwell Automation ThinManager ThinServer is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rockwell Automation ThinManager ThinServer installed on the remote host is 13.0.x through 13.0.7,
13.1.x through 13.1.5, 13.2.x through 13.2.4, or 14.0.x through 14.0.2. It is, therefore, affected by a path
traversal vulnerability:

  - A path traversal vulnerability exists due to improper limitation of file save operations within the API. An
    authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories
    outside of the application's intended directory. (CVE-2026-11917)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1782.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?58dfeced");
  script_set_attribute(attribute:"solution", value:
"Refer to vendor advisory SD1782 for remediation guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11917");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:thinmanager");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SCADA");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rockwell_thinmanager_thinserver_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Rockwell ThinManager ThinServer");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Rockwell ThinManager ThinServer');

var constraints = [
  {'min_version': '13.0.0', 'fixed_version': '13.0.8', 'fixed_display': '13.0.8'},
  {'min_version': '13.1.0', 'fixed_version': '13.1.6', 'fixed_display': '13.1.6'},
  {'min_version': '13.2.0', 'fixed_version': '13.2.5', 'fixed_display': '13.2.5'},
  {'min_version': '14.0.0', 'fixed_version': '14.0.3', 'fixed_display': '14.0.3'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);