CVE-2022-48222

Vulnerability

An issue exists in the Acuant AcuFill SDK before version 10.22.02.03 [1]. During installation, the Acuant installer calls certutil.exe to install certificates [1]. This process is not hidden and runs with elevated privileges, leaving the command window visible and interactive [1].

Exploitation

A standard user can interact with the visible certutil.exe command window that is running with SYSTEM privileges [1]. By exploiting this interactive window, the attacker can break out of the intended process context, gaining access to a full SYSTEM command prompt [1]. This requires only that the user is present during the installation process and can interact with the window; no additional authentication or network access is needed [1].

Impact

Successful exploitation grants the attacker a SYSTEM command prompt, allowing arbitrary code execution at the highest privilege level on the system [1]. This results in complete compromise of the affected machine, including the ability to install programs, view or change data, and create new accounts with full administrative rights [1].

Mitigation

The vendor has addressed this vulnerability in Acuant AcuFill SDK version 10.22.02.03 and later [1]. Users should update to this or a newer version as soon as possible [1]. No workarounds are documented in the available references.