Rockwell Automation Redundancy Module Configuration Tool

Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) is vulnerable to a DLL search-order hijacking issue caused by incorrect default directory permissions (CWE-276). The binary searches directories listed in the system PATH for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users; a local attacker can plant a malicious DLL there, and when an administrator subsequently launches the tool, the malicious DLL is loaded and executes with Administrator or SYSTEM privileges. Exploitation requires low local privileges plus user interaction (an administrator running the tool), and yields full privilege escalation on the affected workstation. Any installation of the Redundancy Module Configuration Tool on Windows where writable PATH directories exist is affected; the available data does not specify affected version ranges. There is no known public proof-of-concept, no entry in the CISA KEV catalog, and EPSS estimates only about a 0.1% probability of exploitation within 30 days.

Do: Upgrade the Redundancy Module Configuration Tool to a patched version when Rockwell Automation publishes one, as no fixed version is identified in the available data. As an interim mitigation, review permissions on directories in the system PATH on Windows hosts running the tool and remove write access for standard (non-administrator) users, and check those directories for unexpected or recently added DLLs. Restrict execution of RM3ConfigTool.exe to administrator accounts until a fix is applied.