KB5070882: Windows Server 2016 WSUS RCE (CVE-2025-59287)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271439);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/11");

  script_cve_id("CVE-2025-59287");
  script_xref(name:"MSKB", value:"5070882");
  script_xref(name:"MSFT", value:"MS25-5070882");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/14");

  script_name(english:"KB5070882: Windows Server 2016 WSUS RCE (CVE-2025-59287)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 5070879, which addresses a remote code execution
vulnerability in Windows Server Update Services (WSUS).

This plugin identifies vulnerable systems by performing the following checks:
  1. Validates the host is an affected Windows Server instance.
  2. Confirms the WSUS feature is installed by confirming the registry key 'Software\Microsoft\Update Services\' is present.
  3. Confirms the 'WsusService.exe' file exists to avoid false positives from incomplete uninstalls of the WSUS feature.
  4. If the service is present, it performs a version check on the 'Microsoft.UpdateServices.BaseApi.dll'
     file to determine if the system has a patched file version.
");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5070882");
  script_set_attribute(attribute:"solution", value:
"Apply Security Update 5070882");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59287");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows_server_2016");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');

get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
var bulletin = 'MS25-10';

var kbs = make_list(
  '5070882'
);

if (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit('SMB/Registry/Enumerated');
get_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);

if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

var build = get_kb_item_or_exit('SMB/CurrentBuild');
if (build != '14393') audit(AUDIT_OS_SP_NOT_VULN);

var share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

var os_name = get_kb_item("SMB/ProductName");
if ("server" >!< tolower(os_name))
  audit(AUDIT_OS_SP_NOT_VULN);

# check key exists
var key= "Software\Microsoft\Update Services\"; 

# Open Registry, query registry value, report back findings
registry_init();

var hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
var wsus_role_enabled = registry_key_exists(handle: hklm, key:key);

RegCloseKey(handle:hklm);
close_registry(close:FALSE);

dbg::detailed_log(lvl:1, msg:"wsus_role_enabled: " + obj_rep(wsus_role_enabled));

if (!wsus_role_enabled)
   audit(AUDIT_HOST_NOT, hotfix_get_audit_report());

var file = 'C:\\Program Files\\Update Services\\Services\\WsusService.exe';
if (!hotfix_file_exists(path:file))
    audit(AUDIT_OS_SP_NOT_VULN);
    
var systemroot = hotfix_get_systemroot();
var winsxs_share = hotfix_path2share(path:systemroot);

var login  = kb_smb_login();
var pass   = kb_smb_password();
var domain = kb_smb_domain();

rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
if (rc != 1)
{
  NetUseDel();
  audit(AUDIT_SHARE_FAIL, winsxs_share);
}

if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');

var basedir = preg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
dbg::detailed_log(lvl:1, msg:"basedir: " + obj_rep(basedir));

var the_session = make_array(
  'login',    login,
  'password', pass,
  'domain',   domain,
  'share',    winsxs_share
);

var files = list_dir(
        basedir:basedir, 
        level:0, 
        dir_pat:"microsoft.updateservices.baseapi_31bf3856ad364e35", 
        file_pat:"microsoft\.updateservices\.baseapi\.dll", 
        max_recurse:1
    );
    
# Looking for # "C:\Windows\WinSxS\msil_microsoft.updateservices.baseapi_31bf3856ad364e35_10.0.26100.1882_none_313802fb81f60ad0\Microsoft.UpdateServices.BaseApi.dll"

dbg::detailed_log(lvl:1, msg:"files found: " + obj_rep(files));

var vuln = hotfix_check_winsxs(os:'10',
                            sp:0,
                            files:files,
                            versions:make_list('10.0.14393.8524'),
                            max_versions:make_list(''),
                            bulletin:bulletin,
                            kb:"5070882"
                            );

dbg::detailed_log(lvl:1, msg:"vuln: " + vuln);

if(vuln)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}