The RATOC RAID Monitoring Manager installer is vulnerable to DLL hijacking, which can lead to full system compromise by an attacker with local access.

The application installer suffers from an uncontrolled search path element (CWE-427), where it searches the current directory to load DLLs. A local, unauthenticated attacker can trick a user into placing a malicious DLL alongside the installer, resulting in arbitrary code execution with administrator privileges.

This vulnerability carries a CVSS score of 7.8, reflecting its high severity due to the potential for complete system takeover. Successful exploitation grants an attacker full administrative control over the host machine, leading to potential data theft, installation of persistent backdoors, and lateral movement within the corporate network.

Immediate Action: Update the RATOC RAID Monitoring Manager for Windows to version 2.00.009.260220 or later as provided by the vendor.

Proactive Monitoring: Monitor system logs for unauthorized installation activities or the execution of unexpected binaries originating from directories where installers are typically staged.

Compensating Controls: Ensure that users do not have local administrative rights, as this restricts the ability of the malicious installer process to impact the broader operating system.

Public Exploit Available: No (exploit_available: false)

Given the potential for administrative code execution, IT administrators should prioritize the deployment of the updated installer across all affected endpoints. Organizations should verify that users are not running software installers from untrusted or public-facing directories to reduce the likelihood of successful DLL hijacking.