TrueConf Windows Client < 8.5.3.884 Download of Code Without Integrity Check Vulnerability (CVE-2026-3502)

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(320363);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id("CVE-2026-3502");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/04/16");

  script_name(english:"TrueConf Windows Client < 8.5.3.884 Download of Code Without Integrity Check Vulnerability (CVE-2026-3502)");

  script_set_attribute(attribute:"synopsis", value:
"The version of TrueConf Windows Client installed on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of TrueConf Windows Client installed on the remote host is prior to 8.5.3.884. It is, therefore, affected
by a vulnerability:

  — A remote code execution vulnerability exists in the TrueConf Client update mechanism due to lack of
    cryptographic verification of update packages. An attacker with control of the TrueConf server can exploit
    this to distribute and execute arbitrary code on connected clients with the privileges of the TrueConf
    application. (CVE-2026-3502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://trueconf.com/products/changelog.html#client-8-5-3-884_2026-03-26
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c22553c1");
  # https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4d348adb");
  script_set_attribute(attribute:"solution", value:
"Update to TrueConf Windows Client version 8.5.3.884 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-3502");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:trueconf:trueconf");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("trueconf_win_installed.nbin");
  script_require_keys("installed_sw/TrueConf Client");

  exit(0);
}

include('vcf.inc');

var app_name = 'TrueConf Client';
var app_info = vcf::get_app_info(app:app_name);

var constraints = [
  {'fixed_version' : '8.5.3.884'}
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);