The vulnerability allows a local user to craft an openssl.cnf file in a writable but non‑existent directory, causing the Insight Agent service, which runs as SYSTEM, to load the file and execute arbitrary commands. This results in full host compromise with SYSTEM‑level privileges. The flaw is a CWE‑829 issue where operations are improperly restricted within an extension component.

The issue affects Rapid7 Insight Agent versions newer than 4.1.0.2 running on Windows hosts. Any installation of the agent in that range is vulnerable if the problematic directory remains writable by standard users.

With a CVSS score of 8.5 the flaw is assessed as high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; an attacker only needs a standard user account and must be able to write to the specified directory. The exploit condition is that the agent attempts to load a configuration file from a path that does not exist but is writable, allowing the planted file to be interpreted and executed by the SYSTEM‑level service. Once executed, the attacker can run arbitrary commands and fully control the host.