CVE-2025-5480: Action1 Agent Privilege Escalation Vulnerability

CVE-2025-5480 Overview

CVE-2025-5480 is a local privilege escalation vulnerability in the Action1 Agent for Windows. The flaw stems from the product loading an OpenSSL configuration file from an unsecured location, allowing an uncontrolled search path element condition [CWE-427]. A local attacker with the ability to execute low-privileged code on the target system can leverage this weakness to execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-26767 and published as ZDI-25-323.

Critical Impact
A low-privileged local user can gain full SYSTEM code execution on hosts running the affected Action1 Agent, resulting in complete compromise of confidentiality, integrity, and availability.

Affected Products

Action1 Agent for Windows (versions prior to the vendor-supplied fix)
Microsoft Windows endpoints running the Action1 Agent
Environments using Action1 for patch management and remote monitoring

Discovery Timeline

2025-06-06 - CVE-2025-5480 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5480

Vulnerability Analysis

The Action1 Agent runs as a SYSTEM-level service on Windows endpoints to execute patch management and remote administration tasks. During startup and cryptographic operations, the agent invokes OpenSSL, which in turn attempts to load an OpenSSL configuration file (openssl.cnf). The agent resolves this configuration file from a directory that is not adequately protected against writes by low-privileged users.

Because OpenSSL configuration files can specify engine modules and provider paths, an attacker who plants a malicious configuration file causes the SYSTEM service to load attacker-controlled code. The result is arbitrary code execution at the highest privilege level on the Windows host. Additional context is available in the Action1 advisory acknowledging ZDI-CAN-26767.

Root Cause

The root cause is an Uncontrolled Search Path Element [CWE-427]. The Action1 Agent relies on OpenSSL's default configuration lookup behavior without pinning the path to a directory protected by strong access control lists (ACLs). When OpenSSL searches for openssl.cnf in a writable location, a non-privileged user can supply a file that the privileged process then trusts.

Attack Vector

The attack requires local access and low-privileged code execution on the target host. The attacker writes a crafted openssl.cnf to the search location that the agent consults. The file abuses OpenSSL's configuration syntax to load a malicious provider or engine dynamic-link library (DLL). When the Action1 Agent service next invokes OpenSSL, the SYSTEM-context process parses the configuration, loads the attacker's DLL, and executes its code. No user interaction is required, and network access is not needed. See the ZDI-25-323 advisory for additional detail.

Detection Methods for CVE-2025-5480

Indicators of Compromise

Unexpected openssl.cnf files present in directories writable by non-administrative users on hosts running the Action1 Agent.
Unsigned or unknown DLLs loaded by the Action1 Agent service process, particularly modules referenced as OpenSSL engines or providers.
New SYSTEM-context child processes spawned by the Action1 Agent service that do not match expected patch management activity.

Detection Strategies

Monitor file creation events for openssl.cnf in non-standard, user-writable paths on endpoints running Action1.
Alert on image loads by the Action1 Agent service where the loaded module resides outside the agent's installation directory.
Correlate low-privileged process activity with subsequent SYSTEM-level process creation tied to the Action1 Agent.

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) and Event ID 11 (File Created) with rules scoped to the Action1 Agent process.
Forward endpoint telemetry to a centralized analytics platform to baseline normal agent behavior and flag deviations.
Review Action1 Agent audit logs for unexpected restarts or configuration reloads following file writes to search-path directories.

How to Mitigate CVE-2025-5480

Immediate Actions Required

Update the Action1 Agent to the fixed version distributed by the vendor as described in the Action1 advisory.
Inventory all Windows endpoints running the Action1 Agent and confirm the installed agent version.
Restrict local logon and code execution rights on servers and workstations where the agent runs with SYSTEM privileges.

Patch Information

Action1 has acknowledged the issue and released an updated Action1 Agent that removes the unsafe OpenSSL configuration search behavior. Administrators should deploy the fixed agent version through the Action1 console or standard software distribution channels. Refer to the vendor advisory and ZDI-25-323 for version details.

Workarounds

Audit and tighten ACLs on any directory the Action1 Agent process consults during startup to remove write access for standard users.
Remove or restrict any pre-existing user-writable openssl.cnf files on endpoints running the agent.
Apply application allowlisting to prevent unauthorized DLLs from being loaded by the Action1 Agent service.

bash

# Configuration example: audit ACLs on a suspected search path directory
icacls "C:\path\to\search\directory"

# Remove write permissions for standard users on the directory
icacls "C:\path\to\search\directory" /remove:g "BUILTIN\Users"
icacls "C:\path\to\search\directory" /remove:g "Authenticated Users"

# Verify no user-writable openssl.cnf remains in the search path
Get-ChildItem -Path C:\ -Filter openssl.cnf -Recurse -ErrorAction SilentlyContinue