Critical Privilege Escalation Vulnerability in Schneider Electric Floating License Manager (CVE-2024-2658) A high-severity vulnerability (CVE-2024-2658) has been identified in Schneider Electric’s Floating License Manager (FLM), specifically within the FlexNet Publisher component a third-party licensing library integrated into industrial automation software. The flaw, classified as CWE-427 (Uncontrolled Search Path Element), allows a local non-administrative user to escalate privileges to NT AUTHORITY\SYSTEM, granting full control over affected systems. ### Vulnerability Mechanics The issue stems from lmadmin.exe, a core licensing service in Schneider Electric FLM, which references a hardcoded OpenSSL configuration file path (`C:\cygwin\home\nightly\LMADMI~1.4\tier1\lmadmin\contrib\openssl\_RELEA~1\openssl\openssl.cnf`). Due to default Windows NTFS permissions, any authenticated user can recreate this directory structure and place a malicious openssl.cnf file containing a dynamic_path parameter pointing to a rogue DLL. When lmadmin.exe (running under NT AUTHORITY\LOCAL SERVICE) restarts via reboot, service restart, or other triggers it loads the attacker-controlled DLL, executing arbitrary code in the service’s context. Exploiting SeImpersonatePrivilege, an attacker can further escalate to NT AUTHORITY\SYSTEM, enabling: - Full system compromise (configuration files, sensitive data, stored credentials). - Lateral movement across industrial networks (engineering workstations, PLCs, SCADA systems). - Disruption of license services, impacting critical automation software availability. ### Affected Systems & Scope - Software: Schneider Electric FLM (versions prior to 3.0.0.0) using FlexNet Publisher ≤11.19.6.0. - Environment: Industrial automation deployments (PLC programming, SCADA, control rooms). - Attack Vector: Local access required; no remote exploitation possible without prior foothold. ### Detection & Mitigation - Detection: Kaspersky Industrial CyberSecurity (KICS) flags vulnerable versions and monitors exploitation attempts, including rogue configuration file creation and DLL loading. - Mitigation Steps: - Upgrade to Schneider Electric FLM 3.0.0.0 or later. - Restrict directory permissions on `C:\cygwin` to deny write access for Authenticated Users. - Isolate FLM on dedicated servers with strict access controls. - Remove FLM if floating licenses are unnecessary, opting for machine-bound licensing. ### Impact Successful exploitation could lead to complete industrial control system (ICS) compromise, enabling attackers to manipulate automation processes, exfiltrate sensitive data, or disrupt operations. The vulnerability underscores risks in third-party dependencies and hardcoded path vulnerabilities in critical infrastructure software.