CVE-2017-20123: 
Viscosity vulnerability analysis and mitigation

A privilege escalation vulnerability was discovered in Viscosity for Windows version 1.6.7, identified as CVE-2017-20123. The vulnerability was found in the DLL Handler component of the ViscosityService, where improper path validation could allow local users to gain elevated system privileges (Full Disclosure).

The vulnerability stems from improper path validation in the ViscosityService component, which allows the execution of OpenVPN with custom DLL files under SYSTEM privileges. The issue was classified as a local privilege escalation vulnerability, requiring local machine access for exploitation (SparkLabs Blog).

If exploited, this vulnerability could allow a local user to gain elevated system privileges on affected Windows systems. The vulnerability specifically impacts the security of the system's privilege hierarchy, though it does not affect the security of VPN connections themselves (SparkLabs Blog).

The vulnerability was addressed in Viscosity version 1.6.8. SparkLabs, the software vendor, encouraged all Windows users to update to version 1.6.8 as soon as possible, particularly those in multi-user or enterprise environments. The update could be installed automatically from within Viscosity or downloaded and installed manually (SparkLabs Blog).