Acunetix 25.11.x for Windows Local Privilege Escalation via wvsc.exe OpenSSL Config Path Hijack

#Requires -Version 5.1
<#
  Check-CVE-2026-6958.ps1
  Checks whether the local host is vulnerable to CVE-2026-6958
  (Acunetix wvsc.exe OpenSSL config path hijack).
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$wvscPaths = @(
    "$env:ProgramFiles\Acunetix\*\wvsc.exe",
    "${env:ProgramFiles(x86)}\Acunetix\*\wvsc.exe",
    "$env:ProgramData\Acunetix\*\wvsc.exe"
)

$found = $false
foreach ($pattern in $wvscPaths) {
    $hits = Get-ChildItem -Path $pattern -ErrorAction SilentlyContinue
    if ($hits) {
        foreach ($exe in $hits) {
            $found = $true
            $ver = $exe.VersionInfo.ProductVersion
            Write-Host "[*] Found wvsc.exe: $($exe.FullName)"
            Write-Host "[*] Product version: $ver"

            # Check if version matches vulnerable 25.11.x
            if ($ver -match '^25\.11\.') {
                Write-Host "[!] Version $ver is in the vulnerable 25.11.x range."

                # Check if the hardcoded build path exists and is writable by non-admins
                $buildRoot = 'C:\builds'
                if (Test-Path $buildRoot) {
                    $acl = Get-Acl $buildRoot
                    $openToUsers = $false
                    foreach ($rule in $acl.Access) {
                        if ($rule.IdentityReference -match 'Users|Authenticated Users|Everyone' -and
                            $rule.FileSystemRights -match 'Write|FullControl|Modify' -and
                            $rule.AccessControlType -eq 'Allow') {
                            $openToUsers = $true
                            break
                        }
                    }
                    if ($openToUsers) {
                        Write-Host "[!!] VULNERABLE — C:\builds exists and is writable by non-admin users."
                        exit 1
                    } else {
                        Write-Host "[+] PATCHED (mitigated) — C:\builds exists but ACLs restrict write to admins/SYSTEM only."
                        exit 0
                    }
                } else {
                    # C:\builds does not exist — check if users can create it
                    $cAcl = Get-Acl 'C:\'
                    $canCreate = $false
                    foreach ($rule in $cAcl.Access) {
                        if ($rule.IdentityReference -match 'Users|Authenticated Users|Everyone' -and
                            $rule.FileSystemRights -match 'CreateDirectories|Write|FullControl|Modify' -and
                            $rule.AccessControlType -eq 'Allow') {
                            $canCreate = $true
                            break
                        }
                    }
                    if ($canCreate) {
                        Write-Host "[!!] VULNERABLE — C:\builds does not exist and non-admin users can create it on C:\."
                        exit 1
                    } else {
                        Write-Host "[+] PATCHED (mitigated) — C:\ ACL prevents non-admin directory creation."
                        exit 0
                    }
                }
            } else {
                Write-Host "[+] Version $ver is outside the known vulnerable range."
                Write-Host "[+] PATCHED"
                exit 0
            }
        }
    }
}

if (-not $found) {
    Write-Host "[*] Acunetix wvsc.exe not found on this host."
    Write-Host "[*] UNKNOWN (not applicable)"
    exit 2
}