DLL Side-Loading × ESET Inspect Connector for Windows

A low-privileged user can create this directory and place a malicious openssl.cnf that uses the dynamic_path directive to load an attacker-controlled DLL.

The ESET Inspect Connector's ElConnector.exe (running as SYSTEM) loads OpenSSL with a hardcoded config path C:\src\vcpkg\packages\openssl_x64-windows-static\openssl.cnf. A low-privileged user can create this directory and place a malicious openssl.cnf that uses the dynamic_path directive to load an attacker-controlled DLL. When the service restarts or initializes OpenSSL, the DLL executes with SYSTEM privileges inside the EDR process, enabling privilege escalation and potential EDR bypass.

Monitor for unexpected DLL loads into security-critical processes (e.g., EDR agents) from user-writable paths like C:\src\vcpkg\packages\, especially when the loading process runs as SYSTEM. Mitigate by applying the vendor patch and restricting write access to directories used by security software.