# Schneider Electric Floating License Manager - CVE-2024-2658 Local Privilege Escalation via Uncontrolled Search Path in FlexNet Publisher

> CVE-2024-2658 is a local privilege-escalation vulnerability (CWE-427, Uncontrolled Search Path Element) in Flexera's FlexNet Publisher, bundled by Schneider Electric's Floating License Manager (FLM). A low-privileged local user can create a hardcoded, normally non-existent directory and plant a malicious openssl.cnf that points the OpenSSL 'dynamic_path' engine directive at an attacker-controlled DLL, which the lmadmin.exe license daemon then loads, yielding elevated code execution in the service's security context.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1053
- **ID:** TL-2026-1053
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-2658

## Description

FlexNet Publisher's lmadmin.exe license-management daemon references an OpenSSL configuration file at a fixed, hardcoded filesystem path (under a Cygwin-derived directory tree such as C:\cygwin\home
ightly\...\contrib\openssl\...\openssl\) that does not exist by default on a standard Windows installation. Because the path lacks access-control validation and the parent directories are frequently writable by the Authenticated Users group, any locally authenticated low-privileged user can create the missing directory structure and drop a crafted openssl.cnf there. That configuration file can set an OpenSSL engine 'dynamic_path' directive to point at an attacker-supplied DLL. When the lmadmin service (or a vendor daemon that has TLS/OpenSSL enabled) starts, restarts, or reloads its OpenSSL engine configuration, it loads and executes the attacker's DLL inside the lmadmin.exe process. Because lmadmin.exe (installed as the 'lmadminSchneider' or equivalent vendor-branded Windows service) commonly runs under a privileged local service account with SeImpersonatePrivilege or similar elevated token privileges, code execution inside that process context allows the attacker to escalate from an unprivileged local account to SYSTEM-equivalent access, typically chained with well-known 'Potato'-family token-impersonation techniques once arbitrary code execution is achieved inside the service. The vulnerability was identified and responsibly disclosed by researcher Xavier DANEST working with Trend Micro's Zero Day Initiative (ZDI-24-359), reported to the vendor on 2023-11-28, and publicly disclosed in a coordinated April 2024 Flexera/ZDI advisory. Kaspersky's Securelist team later (2026-06-26) published an independent technical breakdown covering the exploit chain and detection guidance, framing the risk to industrial environments given FlexNet Publisher's broad reuse as a bundled licensing component across many ICS/OT and enterprise-software vendors beyond Schneider Electric alone. The issue is fixed upstream in FlexNet Publisher 2024 R1 (11.19.6.0); Schneider Electric's own remediation is delivered via Floating License Manager 3.0.0.0 or later, which bundles the patched FlexNet Publisher component.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1134 Access Token Manipulation
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1129 Shared Modules
- T1083 File and Directory Discovery
- T1069 Permission Groups Discovery
- T1543 Create or Modify System Process
- T1222 File and Directory Permissions Modification
- T1057 Process Discovery
- T1012 Query Registry
- T1078 Valid Accounts
- T1569 System Services

## Sources

- [Securelist: Schneider Electric CVE-2024-2658 Vulnerability](https://securelist.com/tr/schneider-electric-cve-2024-2658-vulnerability/120436/)
- [NVD - CVE-2024-2658](https://nvd.nist.gov/vuln/detail/CVE-2024-2658)
- [ZDI-24-359: FlexNet Publisher Uncontrolled Search Path Element Local Privilege Escalation](https://www.zerodayinitiative.com/advisories/ZDI-24-359/)
- [Flexera Community: CVE-2024-2658 FlexNet Publisher Potential Local Privilege Escalation Issue](https://community.flexera.com/s/article/cve-2024-2658-flexnet-publisher-potential-local-privilege-escalation-issue)
- [SentinelOne Vulnerability Database: CVE-2024-2658](https://www.sentinelone.com/vulnerability-database/cve-2024-2658/)
- [CISA ICS Advisory ICSA-25-037-02: Schneider Electric EcoStruxure (Update D)](https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-02)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1053