CVE-2026-9633: Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure all directories on the system PATH that RM3ConfigTool.exe searches for DLLs are not writable by standard (non-administrator) users (fix incorrect default permissions so only administrators/System can write).
- Compensating control
Verify RM3ConfigTool.exe cannot load a DLL from any directory where an unprivileged user can place a malicious file; remove or correct write permissions on those DLL search directories before running the tool as Administrator/SYSTEM.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local non-administrator attacker who can write a malicious DLL to a directory searched through the system path can set up the attack. Exploitation completes only when an administrator runs RM3ConfigTool.exe.
Does exploitation require the tool to be run with elevated privileges?
Yes. The malicious DLL is loaded when an administrator runs the tool, causing the attacker's code to execute in that elevated process with Administrator or SYSTEM privileges.
How can teams determine whether they are exposed?
Review the directories searched through the system path by RM3ConfigTool.exe and identify any that standard non-administrator users can modify. Also investigate writable path directories for unexpected DLLs that could be loaded by the tool.
What can be done if remediation cannot be applied immediately?
Restrict standard-user write access to directories searched through the system path, and avoid running RM3ConfigTool.exe as an administrator until those permissions have been corrected.