Insecure DLL loading in Cognos Dashboards on Cloud Pak for Data - CVE-2024-41739
Published: April 24, 2025
Vulnerability identifier: #VU107926
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-41739
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to dependency confusion. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
Affected software
Cognos Dashboards on Cloud Pak for Data
IBM TXSeries for Multiplatforms
IBM TXSeries for Multiplatforms
How to mitigate CVE-2024-41739
Install updates from vendor's website.