An improper access control vulnerability in TeamViewer Full Client

# Check-CVE-2026-92370.ps1
# Detects TeamViewer installations vulnerable to CVE-2026-92370
# (Remote Session Permission Bypass via Improper Access Control)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'

# Fixed versions per major branch
$fixedVersions = @{
    '15' = [version]'15.82.0.0'
    '14' = [version]'14.7.48855.0'
    '13' = [version]'13.2.36230.0'
}

$tvVersion = $null
$tvSource  = ''

# 1. Check registry locations
$regPaths = @(
    'HKLM:\SOFTWARE\TeamViewer',
    'HKLM:\SOFTWARE\WOW6432Node\TeamViewer',
    'HKCU:\SOFTWARE\TeamViewer'
)
foreach ($rp in $regPaths) {
    if (Test-Path $rp) {
        $v = (Get-ItemProperty -Path $rp -Name 'Version' -ErrorAction SilentlyContinue).Version
        if ($v) { $tvVersion = $v; $tvSource = "registry ($rp)"; break }
    }
}

# 2. Fallback: check file version of TeamViewer.exe
if (-not $tvVersion) {
    $candidates = @(
        "$env:ProgramFiles\TeamViewer\TeamViewer.exe",
        "${env:ProgramFiles(x86)}\TeamViewer\TeamViewer.exe",
        "$env:LOCALAPPDATA\TeamViewer\TeamViewer.exe",
        "$env:ProgramFiles\TeamViewer Host\TeamViewer_Host.exe"
    )
    foreach ($c in $candidates) {
        if (Test-Path $c) {
            $fi = (Get-Item $c).VersionInfo
            $tvVersion = $fi.ProductVersion
            $tvSource = "file ($c)"
            break
        }
    }
}

# 3. Fallback: check running process
if (-not $tvVersion) {
    $proc = Get-Process -Name 'TeamViewer','TeamViewer_Service','TeamViewer_Host' -ErrorAction SilentlyContinue | Select-Object -First 1
    if ($proc) {
        $tvVersion = $proc.FileVersion
        $tvSource = "process ($($proc.ProcessName))"
    }
}

if (-not $tvVersion) {
    Write-Output 'UNKNOWN - TeamViewer not detected on this host.'
    exit 2
}

try {
    $clean = ($tvVersion -replace '[^0-9.]', '').TrimEnd('.')
    $parsed = [version]$clean
    $major  = $parsed.Major.ToString()

    Write-Output "Detected TeamViewer version $tvVersion (source: $tvSource)"

    if ($fixedVersions.ContainsKey($major)) {
        $fixed = $fixedVersions[$major]
        if ($parsed -ge $fixed) {
            Write-Output "PATCHED - Version $parsed >= fixed version $fixed."
            exit 0
        } else {
            Write-Output "VULNERABLE - Version $parsed < fixed version $fixed. CVE-2026-92370 applies."
            exit 1
        }
    } elseif ($parsed.Major -gt 15) {
        Write-Output "PATCHED - Version $parsed is newer than all affected branches."
        exit 0
    } elseif ($parsed.Major -lt 13) {
        Write-Output "UNKNOWN - Version $parsed is older than tracked branches (13/14/15). Likely EOL and vulnerable; confirm with vendor."
        exit 2
    } else {
        Write-Output "UNKNOWN - Version $parsed detected but major branch $major not in fixed-version map."
        exit 2
    }
} catch {
    Write-Output "UNKNOWN - Could not parse TeamViewer version string: $tvVersion"
    exit 2
}