Vulnerabilities

CVSS

8.5 High

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Risk score

68.0

Published

2025-01-30

Status

Published

A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.

Weaknesses

CWE-427

Coverage 1

vulnerability

Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk

A vulnerability (CVE-2024-2658) has been identified in Schneider Electric’s Floating License Manager (FLM), specifically the FlexNet Publisher component, due to an uncontrolled search path element. This allows a local, n…

Securelist · Jun 26, 2026 High

CVE-2024-2658USopensslprivilege escalationindustrial control systems

All articles mentioning it

Advisories and references

• community.flexera.com/s/article/cve-2024-2658-flexnet-publisher-pote...
• zerodayinitiative.com/advisories/ZDI-24-359/