NXLog Agent CVE-2025-67900

Requires the ability to set or influence the OPENSSL_CONF environment variable of the NXLog Agent process on affected versions (before 6.11) and to place a malicious OpenSSL configuration file (referencing a hostile engine/provider module) reachable by the agent. Exploitation is LIMITED by: local access only (AV:L) - no remote/network path; high attack complexity (AC:H), implying timing or environment-control conditions that are not reliably met; dependence on the agent running with privileges higher than the attacker for meaningful escalation; and only versions prior to 6.11 being vulnerable. In hardened deployments where the service environment is fixed/immutable and unprivileged users cannot alter it, the condition cannot be satisfied.

This is a classic OpenSSL configuration-injection flaw (CWE-829): NXLog Agent versions before 6.11 honor the OPENSSL_CONF environment variable, so an attacker who can control that variable can point the agent at a malicious OpenSSL config that loads arbitrary engines/providers - effectively code execution in the agent's context. The signals are consistent but modest in urgency: the input CVSS vector is AV:L/AC:H (local access AND high attack complexity), which already caps real-world reachability, while EPSS is only 0.12% (2nd percentile) and there is no CISA KEV listing and no public POC. That low EPSS and absent KEV align with the local, high-complexity vector - this is not a mass-exploitable remote flaw. The headline 8.1 score is driven almost entirely by S:C (scope change) and C:H/I:H/A:H, i.e. the assumption that the agent runs with elevated privileges and that env-var control yields full host compromise. CONFLICT TO VERIFY: the input vector states PR:N (no privileges) yet the only exploitation path is controlling an environment variable inherited by the agent process, which in most deployments requires existing local access or privilege to modify the service environment - PR:N likely understates the real prerequisite, so treat this as a local privilege-escalation/post-compromise issue rather than an initial-access vulnerability. Net: real but lower-priority; patch-in-normal-cycle unless NXLog Agent runs as root/SYSTEM in a multi-user environment.

A low-privileged local user (or a process able to influence the agent's service environment) sets OPENSSL_CONF to point at an attacker-controlled OpenSSL configuration file that specifies a malicious engine/provider module. When the NXLog Agent starts or reinitializes TLS, it loads that config and executes the attacker's module in the agent's (often elevated) context, escalating privileges. No public exploit code is identified at time of analysis.