Tychon incorporates an OpenSSL component that defines an OPENSSLDIR variable pointing to a subdirectory that may be writable by an unprivileged user on Windows. The application contains a privileged service that utilizes this component. By placing a specially crafted openssl.cnf file in the controllable directory, an attacker can cause the service to read that configuration and execute arbitrary code with SYSTEM privileges. This flaw represents a privilege escalation vulnerability that can lead to full system compromise.

The single affected product is Tychon by the vendor Tychon. No specific versions or build numbers are listed, so all installations using the vulnerable OpenSSL integration are potentially impacted.

EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of publicly disclosed CVSS does not mitigate the inherent risk. The described attack requires local access to the machine so that the attacker can write the malicious configuration file to the controlled OpenSSL directory. Once placed, the privileged service will load the file and execute code with elevated SYSTEM rights, making exploitation straightforward for an attacker with local user privileges. The potential impact is high, as it bypasses all existing access controls and permits unrestricted code execution on the host.