Spacelabs Healthcare Sentinel versions 10

# check-cve-2026-0611.ps1

# Detect likely exposure state for CVE-2026-0611 on a Sentinel host.

# Exit codes:

#   0 = PATCHED

#   1 = UNKNOWN

#   2 = VULNERABLE


[CmdletBinding()]
param()

$ErrorActionPreference = 'SilentlyContinue'

function Write-Result {
    param(
        [string]$Status,
        [string]$Reason,
        [int]$Code
    )
    Write-Output $Status
    Write-Output $Reason
    exit $Code
}

function Get-VersionFromUninstall {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $hits = foreach ($p in $paths) {
        Get-ItemProperty -Path $p | Where-Object {
            $_.DisplayName -match 'Sentinel' -and $_.Publisher -match 'Spacelabs|OSI Systems|Del Mar Reynolds'
        } | Select-Object DisplayName, DisplayVersion, Publisher
    }

    if ($hits) {
        $best = $hits | Where-Object { $_.DisplayVersion } | Select-Object -First 1
        if ($best) { return $best.DisplayVersion }
    }
    return $null
}

function Get-VersionFromFiles {
    $candidates = @(
        'C:\inetpub\wwwroot\Sentinel\Bin\Spacelabs.Lomond.WebPortal.dll',
        'C:\inetpub\wwwroot\Sentinel\Bin\Spacelabs.Lomond.WebPortal.dll.config',
        'C:\Program Files\Spacelabs*\*',
        'C:\Program Files (x86)\Spacelabs*\*'
    )

    foreach ($path in $candidates) {
        $items = Get-ChildItem -Path $path -File -Recurse -ErrorAction SilentlyContinue | Select-Object -First 20
        foreach ($item in $items) {
            $ver = $item.VersionInfo.ProductVersion
            if (-not $ver) { $ver = $item.VersionInfo.FileVersion }
            if ($ver -match '\d+\.\d+(\.\d+)?(\.\d+)?') {
                return $Matches[0]
            }
        }
    }
    return $null
}

function Parse-Version {
    param([string]$VersionText)

    if (-not $VersionText) { return $null }
    if ($VersionText -match '(\d+)\.(\d+)(?:\.(\d+))?(?:\.(\d+))?') {
        $maj = [int]$Matches[1]
        $min = [int]$Matches[2]
        $bld = if ($Matches[3]) { [int]$Matches[3] } else { 0 }
        $rev = if ($Matches[4]) { [int]$Matches[4] } else { 0 }
        return [version]::new($maj,$min,$bld,$rev)
    }
    return $null
}

function Test-AffectedRange {
    param([version]$v)

    if (-not $v) { return $false }

    # Based on public CVE text: affected Sentinel 10.5.x and later 10.x builds,

    # and 11.x before 11.6.0.

    if ($v.Major -eq 10 -and $v.Minor -ge 5) { return $true }
    if ($v.Major -eq 11 -and $v -lt [version]'11.6.0.0') { return $true }
    return $false
}

function Test-PatchedRange {
    param([version]$v)

    if (-not $v) { return $false }
    if ($v.Major -gt 11) { return $true }
    if ($v.Major -eq 11 -and $v -ge [version]'11.6.0.0') { return $true }
    return $false
}

$versionText = Get-VersionFromUninstall
if (-not $versionText) { $versionText = Get-VersionFromFiles }
$parsedVersion = Parse-Version -VersionText $versionText

$listener = Get-NetTCPConnection -State Listen -LocalPort 8989 | Select-Object -First 1
$listenerPresent = $null -ne $listener

$sentinelPath = Test-Path 'C:\inetpub\wwwroot\Sentinel'
$iisWebConfig = Test-Path 'C:\inetpub\wwwroot\Sentinel\Web.config'

$notes = @()
if ($versionText) { $notes += "Detected version: $versionText" } else { $notes += 'Detected version: none' }
$notes += "Listener on 8989: $listenerPresent"
$notes += "Sentinel IIS path present: $sentinelPath"
$notes += "Web.config present: $iisWebConfig"

if (Test-PatchedRange -v $parsedVersion) {
    Write-Result -Status 'PATCHED' -Reason ($notes -join '; ') -Code 0
}

if (Test-AffectedRange -v $parsedVersion) {
    if ($listenerPresent) {
        Write-Result -Status 'VULNERABLE' -Reason ($notes -join '; ') -Code 2
    } else {
        Write-Result -Status 'UNKNOWN' -Reason (($notes + 'Affected version found, but TCP/8989 listener not observed. Exposure may be disabled or not currently active.') -join '; ') -Code 1
    }
}

if ($listenerPresent -and $sentinelPath) {
    Write-Result -Status 'UNKNOWN' -Reason (($notes + 'Sentinel artifacts and TCP/8989 listener observed, but product version could not be confirmed.') -join '; ') -Code 1
}

Write-Result -Status 'UNKNOWN' -Reason (($notes + 'Could not confirm an affected or patched Sentinel version on this host.') -join '; ') -Code 1