« Volver al listado

CVE-2025-5480

Estado: AnalizadaAlta (7.8)—

Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26767.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L, UI:N, PR:L) permite escalada de privilegios. Carga insegura de configuración OpenSSL desde ruta no validada (CWE-427) genera ejecución arbitraria como SYSTEM mediante secuestro de DLL/biblioteca.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionAuditThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account Management

Tecnologías afectadas (1)

Action1 — Agent

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-5480",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5480",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-09T16:47:40.849558Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Action1",
          "product": "Action1",
          "versions": [
            {
              "status": "affected",
              "version": "5.216.617.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-06T19:15:27.757",
  "references": [
    {
      "url": "https://www.action1.com/blog/acknowledging-zdi-can-26767-high-severity-vulnerability-in-action1-agent/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-323/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1.  An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26767."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de escalada de privilegios locales en el elemento de ruta de búsqueda no controlada de Action1. Esta vulnerabilidad permite a atacantes locales escalar privilegios en las instalaciones afectadas de Action1. Para explotar esta vulnerabilidad, un atacante debe primero ejecutar código con pocos privilegios en el sistema objetivo. La falla específica se encuentra en la configuración de OpenSSL. El producto carga un archivo de configuración de OpenSSL desde una ubicación no segura. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código arbitrario en el contexto de SYSTEM. Anteriormente, se denominaba ZDI-CAN-26767."
    }
  ],
  "lastModified": "2026-06-17T09:48:00.183",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:action1:agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2091AAD6-32BD-4957-8B06-9EE0C5A5CCDD",
              "versionEndExcluding": "5.218.620.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}