EUVD-2025-17356CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26767.
Analysis
Local privilege escalation vulnerability in Action1 where an attacker with low-privileged code execution can exploit an insecure OpenSSL configuration file loading mechanism to achieve SYSTEM-level code execution. The vulnerability requires prior code execution capability on the target system but presents a direct path to full system compromise once initial access is obtained. No active exploitation or public POC has been confirmed at this time, but the moderate CVSS score of 7.8 and CWE-427 classification indicate a meaningful risk to Action1 users.
Technical Context
This vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a path traversal weakness where Action1 loads OpenSSL configuration files from an unsecured or predictable location without proper validation. OpenSSL configuration files can contain directives that influence cryptographic operations, engine loading, and library paths. By placing a malicious openssl.cnf or related configuration file in a location that Action1's process will search before the legitimate system configuration, an attacker can inject arbitrary commands or load malicious libraries. The vulnerability likely affects Action1 versions that bundle or depend on OpenSSL without implementing proper search path restrictions. The specific CPE for Action1 would be 'cpe:2.3:a:action1:action1:*:*:*:*:*:*:*:*' with affected versions requiring vendor clarification.
Affected Products
Action1 (specific versions not disclosed in provided description). The ZDI reference ZDI-CAN-26767 suggests responsible disclosure via Zero Day Initiative. Affected installations are those running Action1 with OpenSSL integration on Windows (SYSTEM context escalation implies Windows environment). Without vendor advisory links or CPE version ranges, recommend checking Action1's official security advisory page and vendor documentation for specific affected versions and patch availability.
Remediation
1. Apply the latest Action1 security patch when released by the vendor (reference ZDI-CAN-26767 for tracking). 2. Implement principle of least privilege: run Action1 with minimum necessary privileges, avoiding SYSTEM or Administrator context where possible. 3. Restrict write permissions to directories where Action1 loads OpenSSL configuration files (typically Windows system paths like %WINDIR%\System32 and application installation directories). 4. Use file integrity monitoring (FIM) on OpenSSL configuration files and search paths to detect unauthorized modifications. 5. Isolate Action1 processes in AppContainers or similar sandboxes if Windows version supports it. 6. Monitor process creation and library loading from Action1 for anomalies.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today