CVE-2024-2658 — Local privilege escalation in FlexNet Publisher
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unau…
Published: 2025-01-30 · CVSS: 8.5 · CVSS 4.0
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7