High severity · published Mar 18, 2024
CVE-2024-1605
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges.
Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Control-m · Bmc
9.0.20 before 9.0.20.238; 9.0.21 before 9.0.21.201 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1605
Third Party Advisory
https://cert.pl/en/posts/2024/03/CVE-2024-1604
Third Party Advisory
https://cert.pl/posts/2024/03/CVE-2024-1604
Product
https://www.bmc.com/it-solutions/control-m.html
More from Control-m
9.8
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter
9.8
CVE-2023-26550
A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field
7.8
CVE-2025-48709
BMC Control-M/Server cleartext database credentials in process lists and logs
6.8
CVE-2024-1604
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any…
5.4
CVE-2024-1606
Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code