EUVD-2026-69147
GHSA-f94w-8wrq-px55
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access required; standard user write access (PR:L); admin must run tool (UI:R); DLL executes as SYSTEM representing scope change from user to admin context (S:C).
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.
AnalysisAI
DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds a standard (non-administrator) local or domain user account on the specific Windows host where RM3ConfigTool.exe is installed; (2) at least one directory in the system PATH on that host has incorrect default permissions - writable by standard users - as installed by the Rockwell Automation tool; this is installation-dependent and may not be present on all hosts; (3) an administrator must subsequently launch RM3ConfigTool.exe on the same host after the malicious DLL has been planted (passive user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) scores 7.0 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Rockwell Automation security advisory SD1800 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1800.html for a patched installer or updated version; a specific patched release number was not available in the intelligence provided at time of analysis, so patch version per vendor advisory should be verified directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict NTFS file permissions on the RM3ConfigTool installation directory and all system PATH directories it searches to prevent standard users from writing files; document the complete file search order used by the executable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today