CVE-2025-5480
📋 TL;DR
This vulnerability allows local attackers to escalate privileges on Action1 installations by exploiting an insecure OpenSSL configuration file loading mechanism. Attackers with initial low-privileged access can execute arbitrary code as SYSTEM. Affects Action1 agent installations with vulnerable configurations.
💻 Affected Systems
- Action1 Agent
📦 What is this software?
Agent by Action1
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional tools, and maintain persistence on compromised systems.
If Mitigated
Limited to low-privileged user activities if proper access controls and monitoring prevent initial foothold.
🎯 Exploit Status
Exploitation requires local access and ability to write to the insecure OpenSSL configuration file location. ZDI-CAN-26767 indicates coordinated disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest Action1 agent version (check vendor advisory for specific version)
Vendor Advisory: https://www.action1.com/blog/acknowledging-zdi-can-26767-high-severity-vulnerability-in-action1-agent/
Restart Required: Yes
Instructions:
1. Update Action1 agent to latest version via Action1 console. 2. Restart affected systems. 3. Verify update completion in Action1 dashboard.
🔧 Temporary Workarounds
Restrict write access to OpenSSL config directory
windowsRemove write permissions for non-administrative users to the directory containing OpenSSL configuration files used by Action1.
icacls "C:\Program Files\Action1\openssl\" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict least privilege access controls to prevent low-privileged code execution
- Monitor for suspicious file writes to OpenSSL configuration directories and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Action1 agent version against patched version in vendor advisory. Review OpenSSL configuration file permissions in Action1 installation directory.Check Version:
Check Action1 console dashboard or run: wmic product where "name like 'Action1%'" get versionVerify Fix Applied:
Confirm Action1 agent version is updated to patched version. Verify OpenSSL configuration files are loaded from secure locations only.📡 Detection & Monitoring
Log Indicators:
- Unexpected writes to OpenSSL configuration files
- Process creation with SYSTEM privileges from non-privileged users
- Action1 agent service restarts or crashes
Network Indicators:
- Unusual outbound connections from Action1 agent processes
SIEM Query:
EventID=4688 AND NewProcessName="*\system32\*" AND SubjectUserName!="SYSTEM" AND ParentProcessName="*\Action1\*"