Redundancy Module Configuration Tool CVE-2026-9633

Exploitation requires three concurrent conditions: (1) the attacker holds a standard (non-administrator) local or domain user account on the specific Windows host where RM3ConfigTool.exe is installed; (2) at least one directory in the system PATH on that host has incorrect default permissions - writable by standard users - as installed by the Rockwell Automation tool; this is installation-dependent and may not be present on all hosts; (3) an administrator must subsequently launch RM3ConfigTool.exe on the same host after the malicious DLL has been planted (passive user interaction). Exploitation is strictly local per AV:L - no network-based or unauthenticated remote vector exists. The attack is neutralized if PATH directories enforce administrator-only write ACLs, if the tool is executed exclusively in a clean, controlled environment, or if application allowlisting blocks unsigned DLLs from loading into the process.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) scores 7.0 (High). Local attack vector confirms that remote unauthenticated exploitation is not possible. Low attack complexity and no special attack requirements (AT:N) mean that, once a writable PATH directory is present, the preconditions are consistently exploitable without sophisticated tooling. Full impact on confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H) reflects SYSTEM-level code execution. The passive user interaction requirement (UI:P - an administrator must launch the tool) introduces an operational dependency that limits purely automated exploitation but is realistic in ICS environments where operators routinely run configuration utilities during maintenance windows. EPSS data was not provided, so quantitative exploitation probability versus the broader CVE population cannot be stated. Absence from CISA KEV and no identified public proof-of-concept suggest opportunistic mass exploitation is not occurring at time of analysis; however, this is a credible insider threat, post-compromise lateral movement, or supply-chain sabotage vector in OT environments where attackers prioritize persistence with elevated privileges.

A standard user account on an ICS engineering workstation - such as a technician account or a compromised domain credential - identifies a directory in the system PATH that grants write access to non-administrators due to the tool's installation defaults. The attacker drops a malicious DLL named to match the library RM3ConfigTool.exe resolves at startup, then waits. When an ICS administrator next opens the tool for routine redundancy module configuration or a maintenance task, Windows loads the attacker's DLL into the elevated process before finding the legitimate one, and arbitrary code executes as SYSTEM. No public proof-of-concept exploit has been identified at the time of analysis.