Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2026-9634: Redundancy Module Configuration Tool lets users run code as admin
CVE-2026-9634 · published 2 months ago
Summary
The Redundancy Module Configuration Tool looks for a required library file in any folder listed in the system path. Because some of those folders can be written to by ordinary users, a low‑privilege user could place a malicious library there, and when an administrator later runs the tool the malicious code would execute with full system rights. Limit write access to the folders in the system path or apply the vendor’s update to protect against this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rockwell automation | redundancy module configuration tool | 10.00.00 |
Original advisory text
Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-276Incorrect Default Permissions
Timeline
Published1 Sep 2026
Updated26 Oct 2026
First seen1 Sep 2026
Track software like this
Free during beta