Skip to content
OpenAdvisories
High SEVD-2025-014-07 1 CVE

FlexNet Publisher Vulnerability

Published Jan 14, 2025 · Updated May 12, 2026 · Revision 7

Vendor: Schneider Electric Product: EcoStruxure Architecture Builder Product: EcoStruxure Control Expert Product: EcoStruxure Machine Expert Product: EcoStruxure Operator Terminal Expert Product: EcoStruxure™ Control Expert Asset Link Product: EcoStruxure™ Machine Expert Safety Product: EcoStruxure™ Machine Expert Twin Product: EcoStruxure™ Machine SCADA Expert Asset Link Product: EcoStruxure™ OPC UA Server Expert Product: EcoStruxure™ Process Expert Product: EcoStruxure™ Process Expert 2023 Product: EcoStruxure™ Process Expert for AVEVA System Platform Product: Pro-face BLUE Product: Vijeo Designer Product: Zelio Soft 2

Summary

Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component.
Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers.
Failure to apply the remediation/mitigations provided below may risk a local privilege escalation, which could
lead to the execution of a malicious DLL with elevated privilege.

Vulnerabilities 1

  • High 8.5
    CVE-2024-2658

    Local privilege escalation in FlexNet Publisher

    A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create th…

    Flexera Software FlexNet Publisher

Revision history

  1. #7.0.0

    A remediation is now available for EcoStruxure™ Process Expert for AVEVA System Platform.

  2. #6.0.0

    A remediation is now available for EcoStruxure™ Machine Expert and EcoStruxure™ Machine Expert Twin

  3. #5.0.0

    CVE, CWE, & CVSS Score information was added.

  4. #4.0.0

    A remediation is now available for Zelio Soft 2 and EcoStruxure™ OPC UA Server Expert offers

  5. #3.0.0

    Pro-face BLUE is added to the “Affected Product and Versions” section. Remediations are now available for EcoStruxure™Control Expert, EcoStruxure™ Operator Terminal Expert and Pro-face BLUE offers. Updated the link to the fix of EcoStruxure™ Control Expert Asset Link offer

  6. #2.0.0

    A remediation is available for the EcoStruxure™ Process Expert offer. The EcoStruxure™ Process Expert for AVEVA System Platform offer is added to the “Affected Product and Versions” section

  7. #1.0.0

    Original Release

References