EUVD-2026-52441
GHSA-rv3c-h5mj-3hjw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector, low privilege to write the config file, no user interaction due to automatic startup trigger, full triad impact on the host process.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup.
AnalysisAI
DLL hijacking in Zucchetti FirmaCheck for Windows before 1.3.16 allows local low-privileged attackers to achieve arbitrary code execution at the privilege level of the FirmaCheck startup process. FirmaCheck.exe loads OpenSSL configuration from the unvalidated path C:\Program Files (x86)\Common Files\SSL\ without verifying the integrity or ownership of the directory; an attacker who can write to this location may plant a crafted openssl.cnf referencing an attacker-controlled DLL, which is then loaded automatically when FirmaCheck runs at system startup. No public exploit code or active exploitation has been identified at time of analysis; exploitation is reported by VulnCheck and is bounded by the local access requirement.
Technical ContextAI
FirmaCheck is a Windows-based digital signature and document management tool produced by Zucchetti S.p.A. (CPE: cpe:2.3:a:zucchetti_s.p.a.:firmacheck:*:*:*:*:*:*:*:*). The root cause is CWE-426 (Untrusted Search Path): the application delegates OpenSSL configuration resolution to a directory path - C:\Program Files (x86)\Common Files\SSL\ - that it does not exclusively own or restrict. The OpenSSL configuration file (openssl.cnf) supports directives such as 'dynamic_path' and engine loading stanzas, enabling arbitrary DLL load paths to be declared. Because FirmaCheck does not validate the provenance or integrity of the openssl.cnf it reads, an attacker-supplied configuration file in that directory is silently honored. The vulnerability is triggered at application startup, meaning the malicious DLL is loaded in the process context of FirmaCheck.exe with whatever privileges the startup session carries - potentially SYSTEM-level if the process is launched as a Windows service or via a startup task with elevated context.
RemediationAI
Upgrade FirmaCheck to version 1.3.16 or later, as this is the vendor-confirmed fixed release per the VulnCheck advisory (https://www.vulncheck.com/advisories/firmacheck-dll-hijacking-via-unvalidated-openssl-configuration-path). If immediate upgrade is not possible, restrict write permissions on C:\Program Files (x86)\Common Files\SSL\ to SYSTEM and local Administrators only, removing write access for standard user accounts - this eliminates the condition that allows a low-privileged attacker to plant the malicious openssl.cnf, though it may affect legitimate SSL configuration workflows. As a secondary compensating control, deploy Windows Defender Application Control (WDAC) or AppLocker policies that prevent unsigned DLLs from loading in the FirmaCheck process context; note this requires policy tuning and may break legitimate OpenSSL engine functionality. Additionally, audit existing contents of C:\Program Files (x86)\Common Files\SSL\ for unexpected openssl.cnf files referencing non-vendor DLL paths. Vendor product page: https://www.zucchetti.it/it/cms/soluzioni/gestione-documentale/firme-e-marche/software-gestione-firme-digitali-firmacheck/software-gratuito-gestione-firme-e-documenti-descrizione.html
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today