Redundancy Module Configuration Tool
Monthly
Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.
DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog.
Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.
DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog.