CVE-2024-1605 - CVE House

Back to Database

Status published Medium CVE-2024-1605

DLL side-loading in BMC Control-M

6.6 CVSS

Vulnerability Description

BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1605

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Maksymilian Kubiak [Afine Team]
Dawid Małecki [Afine Team]

References

More from BMC

View All →

BMC Control-M/Agent memory corruption in SSL/TLS communication

BMC Control-M/Agent buffer overflow in SSL/TLS communication

BMC Control-M/Agent buffer overflow local privilege escalation

BMC Control-M/Agent path traversal local privilege escalation

BMC Control-M/Agent improper IP address filtering order

Affected Vendor

BMC

View all reports →

Affected Software

Control-M

Vulnerable Versions:

9.0.20, 9.0.21

Timeline

Official Publish: March 18th, 2024

Last Modified: April 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification

Defense Evasion

T1078 Valid Accounts

T1574 Hijack Execution Flow

Privilege Escalation

T1021 Remote Services

Lateral Movement

T1005 Data from Local System