A local privilege escalation vulnerability in the Acunetix Web Vulnerability Scanning Engine allows low-privileged attackers to gain full SYSTEM-level access to the host machine.

This vulnerability is a local privilege escalation flaw caused by an uncontrolled search path element (CWE-427) within the wvsc.exe binary. The process, which runs with SYSTEM privileges, attempts to load OpenSSL configuration files from a hardcoded directory path that does not exist by default, allowing local unprivileged users to create the directory and inject malicious files for execution.

Successful exploitation of this vulnerability permits a low-privileged local user to escalate their access to SYSTEM privileges, effectively granting full control over the host operating system. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement across the network.

Immediate Action: Contact Invicti Security support to obtain the latest security update or patch for the affected Acunetix Web Vulnerability Scanning Engine. If a patch is not yet available, restrict access to the host machine to trusted personnel only and monitor for unauthorized directory creation attempts.

Proactive Monitoring: Monitor file system activity for the creation of unexpected directories or files within the paths typically utilized by the Acunetix scanning engine. Review system logs for unusual process execution patterns involving wvsc.exe.

Compensating Controls: Ensure that strict file system permissions are applied to the directories used by the Acunetix service, preventing standard users from creating or modifying files in sensitive application paths. Implement endpoint detection and response (EDR) solutions to identify and block unauthorized privilege escalation attempts.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

The severity of this vulnerability, combined with the availability of public proof-of-concept material, necessitates immediate attention. Administrators must prioritize the application of vendor-supplied patches as soon as they become available. In the interim, enforcing strict access controls on the host environment is essential to prevent local unprivileged users from leveraging this insecure search path to achieve full system compromise.