RMConfigTool CVE-2026-9634

Exploitation requires the attacker to already hold a standard (non-administrator) local user account on the Windows host where RMConfigTool.exe is installed - no remote access vector exists. The core enabling condition is the presence of at least one PATH directory with incorrect default write permissions that allows non-admin accounts to create or overwrite files; this misconfiguration must be introduced by the tool's installer or deployment process. Additionally, an administrator must subsequently launch RMConfigTool.exe after the malicious DLL has been placed, making exploitation dependent on administrator behavior (UI:P in CVSS 4.0 terms). Exploitation is bounded by: strictly local-only attack vector, mandatory dependency on an administrator actively running the tool, and the specific PATH directory permission misconfiguration being present on the target host.

The CVSS 4.0 score of 7.0 with vector AV:L/AC:L/AT:N/PR:L/UI:P accurately captures the attack's profile: local-only vector with low complexity but a hard dependency on passive administrator interaction (UI:P) that prevents fully autonomous exploitation. No EPSS score was provided in the input data, and the CVE is not listed in CISA KEV, so there is no confirmed evidence of active exploitation at time of analysis. In practical ICS/OT environments where Rockwell configuration tools are used, administrators frequently run such utilities on shared workstations where standard user accounts co-exist, making the UI:P condition realistic rather than theoretical - even a mid-sized industrial operator in a facility that shares engineering workstations should treat this as a meaningful privilege escalation risk in that environment. The high VC/VI/VA impact metrics are justified because successful exploitation yields full Administrator or SYSTEM execution, giving an attacker complete control over the host. The absence of KEV listing and EPSS data limits confidence in gauging active threat activity; risk prioritization should emphasize environments where non-admin users share workstations with administrators who regularly use this tool.

An attacker with a standard local Windows account on an engineering workstation identifies a PATH directory writable by non-administrators, then drops a malicious DLL named to match one RMConfigTool.exe is expected to load. When an administrator later launches the tool for routine ICS configuration work, Windows resolves the DLL search order and loads the attacker's file into the privileged process, executing arbitrary code as Administrator or SYSTEM. No public exploit code has been identified at time of analysis, but DLL hijacking is a standard post-exploitation technique requiring no specialized tooling beyond basic file system access.