Flexera CVE-2024-2658

Atempo teams are aware of this CVE which is reported by several scanners to impact the currently used lmgrd version 11.18.3 used by Atempo products to obtain license tokens.

Atempo teams have completed the verifications, and were able to conclude that Atempo products are not impacted by this vulnerability.

CVE-2024-2658 impacts lmadmin.exe which is not packaged into the installer provided by Atempo along with their products.

Excerpt from https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2024-2658-FlexNet-Publisher-potential-local-privilege/ta-p/313003 publication:

Description
A misconfiguration in FlexNet Publisher lmadmin.exe allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.