CVE-2022-4991 — Tychon is vulnerable to privilege escalation due to OPENSSLDIR location

CVE-2022-4991

Tychon is vulnerable to privilege escalation due to OPENSSLDIR location PUBLISHED

Description (CNA)

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.

Affected (CNA)

Vendor / product	Versions
Tychon / Tychon	affected * before 1.7.857.82

CWE

No CWE identifiers supplied.

References

https://www.kb.cert.org/vuls/id/730007

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.