What is CVE-2024-2658?

CVE-2024-2658 is a vulnerability in Flexera Flexnet Publisher, classified under Uncontrolled Search Path Element. Published 2025-01-30.

Is CVE-2024-2658 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Flexera Flexnet Publisher

CVE-2024-2658

A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.

EPSS: 0.004 (34.4th percentile) — read the EPSS interpretation.

Affected products

Flexera Flexnet Publisher — versions 0

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

chnzzh/OpenSSL-CVE-lib

References

PSIRT-CNA@flexerasoftware.com (vendor-advisory)
PSIRT-CNA@flexerasoftware.com (third-party-advisory)

Frequently asked questions

What is CVE-2024-2658?: CVE-2024-2658 is a vulnerability in Flexera Flexnet Publisher, classified under Uncontrolled Search Path Element. Published 2025-01-30.
Is CVE-2024-2658 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.