An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent can allow a malicious local user to write to files of their choosing on the system. If they can write to privileged configuration files or other system artifacts, they can elevate their privileges and gain the ability to execute arbitrary code with elevated rights. The vulnerability requires that certain preconditions outside the attacker’s control exist, so it is not trivially exploitable by any local user but can be leveraged in environments where those conditions are met.

Hewlett Packard Enterprise ClearPass Policy Manager (CPPM) resides in the OnGuard agent component of the product. Version details are not supplied in the advisory, so all releases of ClearPass Policy Manager that include the OnGuard agent should be considered potentially vulnerable.

The CVSS score of 6.7 reflects a moderate severity risk. The EPSS score is 0.00094, and the vulnerability is not catalogued in CISA’s KEV list. This flaw is exploitable only from a local environment, potentially requiring that the attacker has a user session on the impacted machine and that specific system conditions are satisfied. Because the attack vector is local and the exploit depends on preconditions, the likelihood of a widespread attack is reduced, but in environments where those conditions exist, successful exploitation could give an attacker full control over the affected machine.