CVE-2026-9634: CWE-276 Incorrect default permissions in Rockwell Automation Redundancy Module Configuration Tool

The Redundancy Module Configuration Tool (RMConfigTool.exe) in Rockwell Automation's product version 10.00.00 improperly sets default permissions on directories included in the system path. This allows non-administrator users to write malicious DLLs into these directories. When an administrator executes the tool, it loads the malicious DLL, which executes with Administrator or SYSTEM privileges. This is a classic case of CWE-276: Incorrect Default Permissions leading to a DLL hijacking attack vector that can escalate local privileges.

An attacker with standard user access can place a malicious DLL in a writable directory searched by the tool. When an administrator runs the tool, the malicious DLL executes with elevated privileges, potentially allowing full system compromise or unauthorized administrative actions.

No official patch or remediation guidance has been published by Rockwell Automation at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions on directories in the system path to prevent unprivileged users from placing files there. Avoid running the Redundancy Module Configuration Tool with administrative privileges unless necessary.