Postecert Firmaok
Monthly
Local privilege escalation in Poste Italiane's Postecert FIRMAOK! 1.6.29 on Windows stems from an uncontrolled OpenSSL search path: launcher.exe, updater.exe and tslupdater.exe resolve OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. An attacker holding a low-privileged local account can create that missing directory and drop a malicious openssl.cnf or OpenSSL library into it, so the application loads attacker-controlled code with the privileges of whoever launches it - yielding horizontal escalation against a peer user, and vertical escalation up to full system compromise only if an administrator subsequently starts the application. A public PoC reference exists on Full Disclosure but is not verified as working exploit code; there is no confirmed active exploitation (not in CISA KEV), and the issue is prioritised for remediation this week rather than treated as an emergency.
Local privilege escalation in Poste Italiane's Postecert FIRMAOK! 1.6.29 on Windows stems from an uncontrolled OpenSSL search path: launcher.exe, updater.exe and tslupdater.exe resolve OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. An attacker holding a low-privileged local account can create that missing directory and drop a malicious openssl.cnf or OpenSSL library into it, so the application loads attacker-controlled code with the privileges of whoever launches it - yielding horizontal escalation against a peer user, and vertical escalation up to full system compromise only if an administrator subsequently starts the application. A public PoC reference exists on Full Disclosure but is not verified as working exploit code; there is no confirmed active exploitation (not in CISA KEV), and the issue is prioritised for remediation this week rather than treated as an emergency.