Thermo Fisher Applied Biosystems Genetic Analyzer Missing Integrity Check on .fsa/.hid Output Files

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-17583.ps1
  Detects whether Thermo Fisher Applied Biosystems Data Collection
  or GeneMapper ID-X software is installed at a vulnerable version.
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$patchedVersions = @{
    '3500 Series Data Collection Software'        = [version]'4.0.3'
    '3500xL Series Data Collection Software'      = [version]'4.0.3'
    '3730 Series Data Collection Software'        = [version]'5.0.3'
    '3730xL Series Data Collection Software'      = [version]'5.0.3'
    'SeqStudio Genetic Analyzer'                  = [version]'1.2.6'
    'SeqStudio Flex Series Instrument Software'   = [version]'1.2.1'
    'GeneMapper ID-X'                             = [version]'1.7.4'
}

# EOL products with no fix available
$eolProducts = @(
    '3130 Series Data Collection Software',
    'ABI PRISM 3100',
    'ABI PRISM 3100-Avant',
    'ABI PRISM 310'
)

$found = $false
$vulnerable = $false

# Search Uninstall registry keys
$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($path in $regPaths) {
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | ForEach-Object {
        $displayName = $_.DisplayName
        if (-not $displayName) { return }

        # Check EOL products first
        foreach ($eol in $eolProducts) {
            if ($displayName -match [regex]::Escape($eol)) {
                $found = $true
                $vulnerable = $true
                Write-Host "[!] EOL PRODUCT FOUND: $displayName (version $($_.DisplayVersion)) - NO PATCH AVAILABLE" -ForegroundColor Red
            }
        }

        # Check patchable products
        foreach ($product in $patchedVersions.Keys) {
            if ($displayName -match [regex]::Escape($product)) {
                $found = $true
                $installedStr = $_.DisplayVersion
                try {
                    $installed = [version]$installedStr
                    $required  = $patchedVersions[$product]
                    if ($installed -lt $required) {
                        $vulnerable = $true
                        Write-Host "[!] VULNERABLE: $displayName v$installed (need >= v$required)" -ForegroundColor Red
                    } else {
                        Write-Host "[+] PATCHED: $displayName v$installed (>= v$required)" -ForegroundColor Green
                    }
                } catch {
                    Write-Host "[?] FOUND but version unparseable: $displayName ($installedStr)" -ForegroundColor Yellow
                }
            }
        }
    }
}

# Also scan common install directories
$searchPaths = @(
    'C:\Applied Biosystems\*',
    'C:\Program Files\Applied Biosystems\*',
    'C:\Program Files (x86)\Applied Biosystems\*',
    'C:\Thermo Fisher Scientific\*'
)

foreach ($sp in $searchPaths) {
    if (Test-Path (Split-Path $sp -Parent)) {
        $dirs = Get-ChildItem -Path $sp -Directory -ErrorAction SilentlyContinue
        foreach ($d in $dirs) {
            if (-not $found) {
                Write-Host "[i] Applied Biosystems installation directory detected: $($d.FullName)" -ForegroundColor Cyan
                Write-Host "    Manual version check recommended if registry detection missed this product." -ForegroundColor Cyan
            }
        }
    }
}

if (-not $found) {
    Write-Host "UNKNOWN - No Thermo Fisher Applied Biosystems software detected on this host." -ForegroundColor Yellow
    exit 2
} elseif ($vulnerable) {
    Write-Host "`nVULNERABLE - One or more products require patching for CVE-2026-17583." -ForegroundColor Red
    exit 1
} else {
    Write-Host "`nPATCHED - All detected products are at or above the fixed version." -ForegroundColor Green
    exit 0
}