OpenSSL CVE-2025-5480

The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local attack vector with low complexity and low privilege requirements, yielding a 7.8 score. However, real-world risk is moderated by the prerequisite requirement: an attacker must already have low-privileged code execution. This is not a remote vulnerability and does not grant unauthenticated access. The lack of confirmed KEV status and public POC suggests this is not currently under active exploitation. For organizations where Action1 runs with elevated privileges or in shared/multi-tenant environments, this represents HIGH priority (privilege escalation from low to SYSTEM). For isolated single-user deployments, risk is MEDIUM. The vulnerability is technically sound (CWE-427 is well-understood and exploitable) but requires a prior compromise, making it a secondary rather than primary attack vector.

An attacker gains initial low-privileged code execution on a Windows system running Action1 (e.g., via phishing malware, compromised software, or legitimate but vulnerable application). The attacker enumerates the search path that Action1's OpenSSL integration uses to load configuration files. If Action1 searches user-writable or partially-writable directories before system directories (common misconfiguration), the attacker drops a crafted openssl.cnf file in that location. When Action1 next initializes OpenSSL (during startup or during cryptographic operations), it loads the malicious configuration, which can include engine directives, library paths, or environment variable expansions that execute attacker-controlled code in the SYSTEM context. The attacker achieves privilege escalation and can install persistence mechanisms, steal credentials, or compromise the system further. Since AC:L and UI:N, no user interaction is required—merely triggering Action1 functionality is sufficient.