{"id":"CVE-2022-25153","aliases":["EUVD-2022-29896","GHSA-h8h7-rvv3-mqvp"],"status":"published","title":"ITarian - Local privilege escalation in Endpoint Manager agent on Windows","description":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00342,"percentile":0.28086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-275"],"published":"2022-06-08T00:00:00Z","modified":"2026-06-17T04:33:06Z","products":[{"vendor":"itarian","product":"endpoint manager communication client for windows"},{"vendor":"itarian","product":"endpoint_manager_communication_client"}],"references":[{"url":"https://csirt.divd.nl/DIVD-2021-00037","tags":["third-party-advisory","x_transferred","Third Party Advisory"]},{"url":"https://csirt.divd.nl/CVE-2022-25153","tags":["third-party-advisory","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25153"},{"url":"https://csirt.divd.nl/cases/DIVD-2021-00037"},{"url":"https://github.com/advisories/GHSA-h8h7-rvv3-mqvp"}],"sources":{"cve":[{"id":"CVE-2022-25153","title":"ITarian - Local privilege escalation in Endpoint Manager agent on Windows","description":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.","status":"published","published":"2022-06-08T00:00:00Z","modified":"2025-03-11T13:39:17.61Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-275"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-29896","description":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.","status":"published","published":"2022-06-08T00:00:00Z","modified":"2025-03-11T13:39:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:08.182954Z"}],"ghsa":[{"id":"GHSA-h8h7-rvv3-mqvp","title":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled...","description":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.","status":"published","published":"2022-06-10T00:00:55Z","modified":"2023-01-30T05:01:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:46:22.963176Z"}],"nvd":[{"id":"CVE-2022-25153","description":"The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.","status":"published","published":"2022-06-09T17:15:08.903Z","modified":"2026-06-17T04:33:06.217Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-275"],"updated_at":"2026-11-02T14:07:21.62951Z"}]}}