Tychon OpenSSL Privilege Escalation Vulnerability Allowing Arbitrary Code Execution

A privilege escalation vulnerability has been identified in Tychon due to its OpenSSL component, which allows an unprivileged user on Windows to control the OPENSSLDIR variable. Tychon includes a privileged service that utilizes this OpenSSL component. By placing a specially-crafted openssl.cnf file in a designated path, a user may execute arbitrary code with SYSTEM privileges.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with SYSTEM privileges on a Windows system running the affected Tychon version.

Remediation

Users can update to Tychon version 1.7.857.82 to address this vulnerability.