Potentially Malicious Libraries Loaded by Control-M Could Lead to Privilege Escalation

CVE-2024-1605

What is CVE-2024-1605?

BMC Control-M versions 9.0.20 and 9.0.21 have a vulnerability where user login allows the loading of Dynamic Link Libraries (DLLs) from a directory with open Read and Write permissions. This design flaw can be exploited to load a malicious library that executes with the privileges of the application, potentially compromising the integrity and security of the system.

References