Technical impact
Tychon incorporates an OpenSSL component that defines an OPENSSLDIR variable pointing to a subdirectory that may be writable by an unprivileged user on Windows. The application contains a privileged service that utilizes this component. By placing a specially crafted openssl.cnf file in the controllable directory, an attacker can cause the service to read that configuration and execute arbitrary code with SYSTEM privileges. This flaw represents a privilege escalation vulnerability that can lead to full system compromise.
Affected Systems
The single affected product is Tychon by the vendor Tychon. No specific versions or build numbers are listed, so all installations using the vulnerable OpenSSL integration are potentially impacted.
Risk and Exploitability
EPSS indicates a very low but non‑zero exploitation probability at < 1%, and the vulnerability is not listed in CISA’s KEV catalog, but the CVSS score of 7.4 highlights significant potential impact. The described attack requires local access to the machine so that the attacker can write the malicious configuration file to the controlled OpenSSL directory. Once placed, the privileged service will load the file and execute code with elevated SYSTEM rights, making exploitation straightforward for an attacker with local user privileges. The potential impact is high, as it bypasses all existing access controls and permits unrestricted code execution on the host.
