CVE-2024-9491

CVE-2024-9491 is a DLL hijacking vulnerability stemming from an uncontrolled search path in the Configuration Wizard 2 installer, associated with Silicon Labs software. This issue, classified under CWE-427, enables privilege escalation and arbitrary code execution when the affected installer is executed. It carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and was published on 2025-01-24.

The vulnerability can be exploited by a local attacker with no required privileges who tricks a user into running the impacted installer, such as through social engineering. Successful exploitation allows the attacker to achieve privilege escalation and execute arbitrary code with elevated permissions due to the scope change from user interaction.

Mitigation details are outlined in the Silicon Labs community advisory at https://community.silabs.com/068Vm00000JUQwd.