The Apache Lounge Windows distribution of Apache HTTP Server includes a hardcoded configuration path that points to openssl.cnf. If an attacker can modify the file at that location, the server will load and parse the configuration with elevated privileges, potentially executing unintended OpenSSL directives or other malicious content. This flaw therefore allows local code execution because the server process interprets the vulnerable configuration file. The vulnerability arises from hardcoding the openssl.cnf path within the Apache Lounge Windows build, without any safeguard against unauthorized modification. As a result, any user or process with sufficient file system access can supply a malicious configuration, leading to arbitrary code execution. The aided exploitation requires local file system write access to the hardcoded openssl.cnf file, situating the attack as a local exploitation scenario. The absence of an EPSS score and the lack of a CISA KEV listing are noted, but the risk remains high due to the elevated privilege context of the web server process and the potential for arbitrary code execution.

The affected product is the Apache HTTP Server Project’s Apache Lounge Windows distribution. No specific version range is documented; thus any installation of the Apache Lounge Windows build that retains the hardcoded openssl.cnf path is considered vulnerable. The flaw impacts all instances that run the server under the default internal path, regardless of the Windows OS version.

The flaw requires that an attacker has local file system access to modify the hardcoded openssl.cnf file, so it is a local exploitation vector. Because the web server process runs with elevated rights, successful exploitation grants arbitrary code execution. The EPSS score is < 1%, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. With a CVSS score of 8.4, this flaw is considered high severity, and the issue carries a high risk assessment, as local compromise of the Apache Lounge Windows installation could allow an attacker to run arbitrary commands with web server privileges.