CVE-2019-12572

CVE-2019-12572 describes a privilege escalation vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows. An authenticated, local attacker can exploit a weakness in how the PIA Windows service loads the OpenSSL library, specifically its attempt to load a non-existent configuration file. By creating a malicious configuration file in a predictable location, an attacker can load an arbitrary OpenSSL engine library, leading to arbitrary code execution with SYSTEM privileges when the service starts. This vulnerability has a CVSS score of 7.8 (HIGH), indicating a significant risk due to its low attack complexity and the potential for complete compromise of confidentiality, integrity, and availability. The attack vector is local, requiring prior authentication to the system. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.