Arbitrary Code Execution Vulnerability in Tychon by a Leading Security Vendor

CVE-2022-4991

What is CVE-2022-4991?

The Tychon software incorporates an OpenSSL component that sets the OPENSSLDIR variable to a directory which can be altered by a non-privileged user on Windows systems. This configuration poses a security risk as it enables malicious users to deploy a specifically crafted openssl.cnf file at a targeted location. If leveraged successfully, this can lead to arbitrary code execution with SYSTEM-level privileges, thereby compromising the security of the entire system.

References