Zucchetti - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/zucchetti/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 03 Aug 2026 22:49:10 +0000DLL Hijacking in FirmaCheck for Windows via Unvalidated OpenSSL Configurationhttps://feed.craftedsignal.io/briefs/2026-08-firmacheck-dll-hijacking/Mon, 03 Aug 2026 22:49:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-firmacheck-dll-hijacking/FirmaCheck for Windows versions prior to 1.3.16 are susceptible to local privilege escalation and arbitrary code execution due to an unvalidated OpenSSL configuration file path.FirmaCheck for Windows, a document signing utility by Zucchetti, contains a DLL hijacking vulnerability (CVE-2026-41447) affecting all versions prior to 1.3.16. The vulnerability stems from the application's failure to properly validate the directory path when loading the OpenSSL configuration file (openssl.cnf). An attacker with local access to the system can place a maliciously crafted openssl.cnf file into the C:\Program Files (x86)\Common Files\SSL\ directory. When the FirmaCheck.exe process initializes, it inadvertently loads a DLL specified within the attacker-controlled configuration file. Because FirmaCheck.exe is configured to execute automatically upon system startup, this flaw allows a local attacker to achieve arbitrary code execution with the privileges of the startup process, facilitating persistence and privilege escalation.

Attack Chain

  1. Attacker gains local access to the target Windows system.
  2. Attacker identifies the path C:\Program Files (x86)\Common Files\SSL\ as a writable location or utilizes elevated privileges to create the directory structure if it does not exist.
  3. Attacker crafts a malicious openssl.cnf file configured to load an attacker-supplied DLL.
  4. Attacker places the malicious openssl.cnf file into the target directory.
  5. Attacker places the payload DLL on the system in a location referenced by the crafted configuration file.
  6. The target system reboots or the user logs in, triggering the automatic execution of FirmaCheck.exe.
  7. FirmaCheck.exe reads the malicious openssl.cnf file during its initialization sequence.
  8. FirmaCheck.exe executes the malicious DLL, granting the attacker code execution at the process privilege level.

Impact

Successful exploitation allows a local attacker to execute arbitrary code on the affected Windows host. This facilitates persistence, potential privilege escalation, and full compromise of the local machine. The vulnerability affects all users of FirmaCheck prior to version 1.3.16, primarily impacting organizations using this software for document management and digital signatures.

Recommendation

Prioritized actions for detection and remediation:

  • Upgrade FirmaCheck to version 1.3.16 or later immediately to patch CVE-2026-41447.
  • Deploy the Sigma rule provided in this brief to monitor for unauthorized creation of openssl.cnf files in standard paths.
  • Audit the C:\Program Files (x86)\Common Files\SSL\ directory for suspicious configuration files or unexpected DLL files if patching cannot be performed immediately.
]]>highadvisoryvulnerabilitydll-hijackinglocal-privilege-escalation