Incorrect DCOM Privilege Assignment in ICONICS GENESIS64 / ICONICS Suite Installer

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-16438.ps1
  Detects CVE-2026-16438: Incorrect DCOM Privilege Assignment in GENESIS64 / ICONICS Suite
  Output: VULNERABLE | PATCHED | UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$result = 'UNKNOWN'
$exitCode = 2

try {
    # --- Step 1: Detect installed ICONICS / GENESIS64 version ---
    $regPaths = @(
        'HKLM:\SOFTWARE\ICONICS',
        'HKLM:\SOFTWARE\WOW6432Node\ICONICS',
        'HKLM:\SOFTWARE\Mitsubishi Electric\MC Works64'
    )
    $installedVersion = $null
    $productName = $null
    $isMCWorks64 = $false

    foreach ($rp in $regPaths) {
        if (Test-Path $rp) {
            if ($rp -match 'MC Works64') {
                $isMCWorks64 = $true
                $productName = 'MC Works64'
                Write-Host "[*] Detected MC Works64 installation (ALL versions vulnerable, no patch available)"
                break
            }
            $verKey = Get-ItemProperty -Path $rp -Name 'Version' -ErrorAction SilentlyContinue
            if ($verKey) {
                $installedVersion = $verKey.Version
                $productName = 'ICONICS Suite / GENESIS64'
            }
            # Fallback: check DisplayVersion under Uninstall keys
            if (-not $installedVersion) {
                $uninstall = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue |
                    Get-ItemProperty | Where-Object { $_.DisplayName -match 'GENESIS64|ICONICS Suite' }
                if ($uninstall) {
                    $installedVersion = $uninstall.DisplayVersion
                    $productName = $uninstall.DisplayName
                }
            }
        }
    }

    if (-not $installedVersion -and -not $isMCWorks64) {
        Write-Host '[?] No GENESIS64, ICONICS Suite, or MC Works64 installation detected.'
        Write-Host 'UNKNOWN'
        exit 2
    }

    if ($isMCWorks64) {
        Write-Host '[!] MC Works64 detected - ALL versions are vulnerable with NO patch available.'
        Write-Host '[!] Mitsubishi Electric recommends migration to ICONICS Suite 10.98+.'
        $result = 'VULNERABLE'
        $exitCode = 1
    } else {
        Write-Host "[*] Detected: $productName version $installedVersion"
        # Parse version - vulnerable if <= 10.97.3
        try {
            $ver = [Version]$installedVersion
            $fixedVer = [Version]'10.98.0'
            if ($ver -ge $fixedVer) {
                Write-Host "[+] Version $installedVersion >= 10.98 (patched range)"
                $result = 'PATCHED'
                $exitCode = 0
            } else {
                Write-Host "[-] Version $installedVersion < 10.98 (vulnerable range: <= 10.97.3)"
                $result = 'VULNERABLE'
                $exitCode = 1
            }
        } catch {
            Write-Host "[?] Could not parse version string: $installedVersion"
        }
    }

    # --- Step 2: Check DCOM default Launch/Activation permissions ---
    Write-Host ''
    Write-Host '[*] Checking DCOM Machine Launch/Activation permissions...'
    $machineLaunchReg = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Ole' -Name 'MachineLaunchRestriction' -ErrorAction SilentlyContinue)
    if ($machineLaunchReg) {
        $sd = $machineLaunchReg.MachineLaunchRestriction
        Write-Host "[*] MachineLaunchRestriction SDDL present ($($sd.Length) bytes)"
        Write-Host '[*] Manual review recommended: use dcomcnfg.exe > COM Security > Launch and Activation Permissions'
        Write-Host '[*] Verify no overly broad grants exist for the ICONICS admin account.'
    } else {
        Write-Host '[!] No MachineLaunchRestriction found - using Windows defaults (potential concern).'
    }

    # Check if DCOM is enabled
    $dcomEnabled = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Ole' -Name 'EnableDCOM' -ErrorAction SilentlyContinue).EnableDCOM
    if ($dcomEnabled -eq 'Y') {
        Write-Host '[*] DCOM is ENABLED on this host.'
    } else {
        Write-Host '[+] DCOM is DISABLED on this host (mitigates remote exploitation).'
        if ($result -eq 'VULNERABLE') {
            Write-Host '[*] Note: Version is vulnerable but DCOM disabled reduces risk.'
        }
    }

} catch {
    Write-Host "[?] Error during check: $_"
    $result = 'UNKNOWN'
    $exitCode = 2
}

Write-Host ''
Write-Host "=== Result: $result ==="
exit $exitCode