Postecert FIRMAOK! CVE-2026-9661

Requires an authenticated low-privileged local account on the Windows host; exploitation is not remote. The specific precondition is that launcher.exe, updater.exe and tslupdater.exe of FIRMAOK! 1.6.29 resolve OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default - the attacker must first create that missing directory and place a malicious openssl.cnf or OpenSSL library inside it. Horizontal escalation only yields the privileges of the user who runs the application; vertical escalation to full system compromise is LIMITED by the requirement that a higher-privileged user (e.g. an administrator) independently launches FIRMAOK! after the malicious files are planted - a condition outside the attacker's direct control. Exploitation is further bounded to version 1.6.29 on Windows.

This is a genuine but conditional local privilege-escalation issue, not a remotely critical emergency. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N, base 7.3) is internally consistent with the description: exploitation is strictly local (AV:L), requires an already-authenticated low-privileged user (PR:L), and carries higher attack complexity (AC:H) because the most serious outcome - vertical escalation to SYSTEM - depends on a higher-privileged user independently choosing to run FIRMAOK!, a condition the attacker does not control. Impact is high across confidentiality, integrity and availability (VC/VI/VA:H) since attacker-controlled OpenSSL config/library code executes in the victim's process. There is no CISA KEV entry and no EPSS score in the provided data, so there is no signal of active or widespread exploitation; a public PoC reference exists but is not verified as working exploit code, so POC availability must not be read as active exploitation. The vuln.today priority is 'this_week', which is an elevated-but-not-emergency urgency consistent with a credible local EoP reported by VulnCheck rather than mass exploitation. Net: prioritize for patching on a near-term (this-week) cycle where FIRMAOK! is deployed, but it is not a drop-everything internet-facing crisis. Note one caveat for verification: the publicly assigned vector uses AC:H, yet the core precondition (a user-writable missing directory an attacker can simply create) is largely attacker-controlled - the AC:H rating appears to hinge on the dependency on a privileged user running the app, so confirm the intended basis with the advisory.

On a shared Windows host, a low-privileged user creates the hardcoded OpenSSL search directory (which does not exist by default) and plants a malicious openssl.cnf or OpenSSL DLL in it. When FIRMAOK!'s launcher.exe, updater.exe or tslupdater.exe next runs, it loads the attacker's config/library and executes their code in the context of whoever launched it; if an administrator or higher-privileged user runs the application, this yields vertical escalation up to full system compromise. A public PoC reference exists (full-disclosure post) but is not verified as working exploit code.