Logitech Logi Options+ Updater Service Local Privilege Escalation to SYSTEM

#Requires -Version 5.1
<#
.SYNOPSIS
  CVE-2026-12518 - Logitech Logi Options+ updater LPE version checker
.DESCRIPTION
  Determines whether the installed Logi Options+ version is in the
  vulnerable range (1.88.0 - 2.6.x). Outputs VULNERABLE / PATCHED / UNKNOWN.
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'

# Search both 64-bit and 32-bit uninstall registry hives
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$logiApp = $null
foreach ($regPath in $uninstallPaths) {
    $logiApp = Get-ItemProperty $regPath 2>$null |
        Where-Object { $_.DisplayName -match 'Logi Options\+|LogiOptionsPlus' } |
        Select-Object -First 1
    if ($logiApp) { break }
}

if (-not $logiApp) {
    # Fallback: check for the updater service directly
    $svc = Get-Service -Name 'LogiOptionsPlus*' 2>$null
    if (-not $svc) {
        Write-Host 'UNKNOWN - Logitech Logi Options+ does not appear to be installed.'
        exit 2
    }
    $wmiSvc = Get-WmiObject Win32_Service -Filter "Name LIKE 'LogiOptionsPlus%'" 2>$null
    if ($wmiSvc -and $wmiSvc.PathName) {
        $exePath = $wmiSvc.PathName.Trim('"')
        $fileVer = (Get-Item $exePath 2>$null).VersionInfo.FileVersion
        if ($fileVer) {
            try { $installedVersion = [version]($fileVer -replace '[^0-9.]','') }
            catch { }
        }
    }
    if (-not $installedVersion) {
        Write-Host 'UNKNOWN - Logi Options+ service found but version cannot be determined.'
        exit 2
    }
} else {
    $verString = $logiApp.DisplayVersion
    if (-not $verString) {
        Write-Host 'UNKNOWN - Logi Options+ installed but DisplayVersion is empty.'
        exit 2
    }
    try {
        # Normalize: take major.minor.build (first 3 segments)
        $segments = ($verString -replace '[^0-9.]','') -split '\.' | Select-Object -First 3
        $installedVersion = [version]($segments -join '.')
    } catch {
        Write-Host "UNKNOWN - Cannot parse version string '$verString'."
        exit 2
    }
}

$fixedVersion  = [version]'2.7.0'
$minAffected   = [version]'1.88.0'

Write-Host "Detected Logi Options+ version: $installedVersion"

if ($installedVersion -ge $fixedVersion) {
    Write-Host "PATCHED - Version $installedVersion >= 2.7.0. CVE-2026-12518 is remediated."
    exit 0
} elseif ($installedVersion -ge $minAffected) {
    Write-Host "VULNERABLE - Version $installedVersion is in affected range (1.88.0 - 2.6.x). Update to >= 2.7.0."
    exit 1
} else {
    Write-Host "UNKNOWN - Version $installedVersion is below known affected range. Manual review recommended."
    exit 2
}