This vulnerability involves incorrect permission assignment (CWE-732) for critical resource files within the Rapid7 Insight Agent installer on Windows. The certificate files, including client.key, located in the bootstrap/common/ssl directory, are accessible with read and execute permissions to standard users. This exposure risks unauthorized access to agent identity credentials. The CVSS 4.0 base score is 6.8 (medium), reflecting local attack vector with low complexity and no user interaction required. The vendor has not yet provided an official fix or remediation guidance, and no exploits have been observed in the wild.

The impact is the potential unauthorized local access to sensitive certificate files, including client.key, which could compromise the identity of the Insight Agent. This exposure could facilitate further local privilege escalation or impersonation attacks if exploited. However, exploitation requires local authenticated access, limiting the attack scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the bootstrap/common/ssl directory manually by adjusting file permissions to limit read and execute access to only necessary system accounts. Monitor vendor communications for updates on official patches or mitigations.