CVE-2022-46782: 
Stormshield SSL VPN Client vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2022-46782) was discovered in Stormshield SSL VPN Client versions prior to 3.2.0. The vulnerability was discovered on December 6, 2022, and publicly disclosed on January 26, 2023. The issue affects the SSL VPN Client software and allows a logged-in user with limited permissions to potentially escalate their privileges to administrator level (Vendor Advisory).

The vulnerability allows a logged-in user who can only launch the VPNSSL Client to use the OpenVPN instance to execute malicious code as administrator on the local machine. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements but high potential impact (NVD).

The vulnerability can lead to multiple severe impacts including privilege escalation to administrator level, potential execution of arbitrary code with elevated privileges, and complete system compromise. The CVSS scoring indicates high impacts on confidentiality, integrity, and availability of the affected system (Vendor Advisory).

No workaround solution was available for this vulnerability. The only recommended mitigation is to upgrade to Stormshield SSL VPN Client version 3.2.0 or later, which contains the fix for this vulnerability (Vendor Advisory).

The vulnerability was responsibly disclosed by Daniel Kalinowski of ISEC.pl Research Team. The vendor, Stormshield, acknowledged the researcher's contribution in their security advisory (Vendor Advisory).