Files or directories accessible to external parties vulnerability in ABB T-MAC Plus

# check-tmacplus-cve-2025-14771.ps1

# Checks ABB T-MAC Plus version and basic IIS hardening indicators tied to CVE-2025-14771.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    $items = foreach ($p in $paths) {
        Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -and $_.DisplayName -match 'T-MAC\s*Plus' }
    }
    $items | Sort-Object DisplayVersion -Descending
}

function Parse-VersionParts([string]$v) {
    if ([string]::IsNullOrWhiteSpace($v)) { return $null }
    $parts = @($v -split '[^0-9]+' | Where-Object { $_ -ne '' } | ForEach-Object { [int]$_ })
    if ($parts.Count -eq 0) { return $null }
    while ($parts.Count -lt 3) { $parts += 0 }
    return ,$parts
}

function Compare-Version([string]$left, [string]$right) {
    $l = Parse-VersionParts $left
    $r = Parse-VersionParts $right
    if (-not $l -or -not $r) { return $null }
    $max = [Math]::Max($l.Count, $r.Count)
    while ($l.Count -lt $max) { $l += 0 }
    while ($r.Count -lt $max) { $r += 0 }
    for ($i = 0; $i -lt $max; $i++) {
        if ($l[$i] -gt $r[$i]) { return 1 }
        if ($l[$i] -lt $r[$i]) { return -1 }
    }
    return 0
}

function Get-IISState {
    $result = [ordered]@{
        IISPresent = $false
        DirectoryBrowseEnabled = $null
        DefaultWebSiteExists = $null
        DefaultWebSiteStarted = $null
        Error = $null
    }

    try {
        if (Get-Module -ListAvailable -Name WebAdministration) {
            Import-Module WebAdministration -ErrorAction Stop
            $result.IISPresent = $true

            try {
                $db = Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter 'system.webServer/directoryBrowse' -Name 'enabled' -ErrorAction Stop
                $result.DirectoryBrowseEnabled = [bool]$db.Value
            } catch {
                $result.DirectoryBrowseEnabled = $null
            }

            try {
                $site = Get-Website -Name 'Default Web Site' -ErrorAction SilentlyContinue
                if ($site) {
                    $result.DefaultWebSiteExists = $true
                    $result.DefaultWebSiteStarted = ($site.State -eq 'Started')
                } else {
                    $result.DefaultWebSiteExists = $false
                    $result.DefaultWebSiteStarted = $false
                }
            } catch {
                $result.DefaultWebSiteExists = $null
                $result.DefaultWebSiteStarted = $null
            }
        }
    } catch {
        $result.Error = $_.Exception.Message
    }

    return [pscustomobject]$result
}

try {
    $apps = Get-UninstallEntries
    $app  = $apps | Select-Object -First 1

    if (-not $app) {
        Write-Output 'UNKNOWN - T-MAC Plus not found in uninstall registry keys'
        exit 2
    }

    $displayName = $app.DisplayName
    $displayVersion = $app.DisplayVersion
    $cmp = Compare-Version $displayVersion '4.0-25'

    $iis = Get-IISState

    $versionVulnerable = $false
    $versionPatched = $false

    if ($cmp -eq $null) {
        $versionState = 'unknown'
    } elseif ($cmp -lt 0) {
        $versionState = 'vulnerable'
        $versionVulnerable = $true
    } else {
        $versionState = 'patched'
        $versionPatched = $true
    }

    $iisIndicators = @()
    $iisVulnerable = $false

    if ($iis.IISPresent) {
        if ($iis.DirectoryBrowseEnabled -eq $true) {
            $iisIndicators += 'IIS directory browsing is enabled'
            $iisVulnerable = $true
        }
        if ($iis.DefaultWebSiteExists -eq $true -and $iis.DefaultWebSiteStarted -eq $true) {
            $iisIndicators += 'Default Web Site exists and is started'
            $iisVulnerable = $true
        } elseif ($iis.DefaultWebSiteExists -eq $true) {
            $iisIndicators += 'Default Web Site exists (stopped)'
        }
    }

    if ($versionVulnerable -or $iisVulnerable) {
        $msg = "VULNERABLE - $displayName version $displayVersion"
        if ($iisIndicators.Count -gt 0) { $msg += '; ' + ($iisIndicators -join '; ') }
        Write-Output $msg
        exit 1
    }

    if ($versionPatched) {
        $msg = "PATCHED - $displayName version $displayVersion"
        if ($iisIndicators.Count -gt 0) { $msg += '; note: ' + ($iisIndicators -join '; ') }
        Write-Output $msg
        exit 0
    }

    Write-Output "UNKNOWN - unable to compare installed version '$displayVersion' to fixed version 4.0-25"
    exit 2
}
catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}