CVE-2024-1605 is a medium severity (CVSS 6.6) DLL side-loading flaw in BMC Control-M. On user login the application loads libraries from a directory that is readable and writable by all users, so a malicious library could run with the application's privileges. Fixed in 9.0.20.238 and 9.0.21.201.
What's affected
CERT Polska's advisory of 18 March 2024 lists Control-M versions from 9.0.20 before 9.0.20.238, and from 9.0.21 before 9.0.21.201 as affected for this CVE. The NVD record says the same: the fix for the 9.0.20 branch is 9.0.20.238, and for 9.0.21 it is 9.0.21.201.
The advisory covers two other BMC Control-M issues: CVE-2024-1604, improper authorization in report management, and CVE-2024-1606, HTML injection in generated web pages, which has a slightly different fixed build for 9.0.21, namely 9.0.21.200. Your upgrade should clear all three.
How to check if you're exposed
Check the Control-M client version in the application's About dialog. Compare it with the two fixed builds above.
Then check the folder the client loads libraries from. If ordinary users can write to it, anyone on the machine can place files there. Windows file properties, or icacls on the folder, show the permissions.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find Control-M client installations and their versions.
- Upgrade to 9.0.20.238 or 9.0.21.201 or later in your branch.
- Tighten folder permissions so only administrators can write to the library directory.
- Review who has interactive access to machines that run the client.
- Apply the fixes for CVE-2024-1604 and CVE-2024-1606 in the same upgrade.
Why it matters
The record classes this as CWE-276, incorrect default permissions. The installation granted everyone write access to a place the program trusted for code, so any local user could plant a library that other users' sessions would load.
The attack is local and needs a user on the same machine, which holds the score at 6.6. On shared servers and jump hosts, though, planting code that runs as a more privileged colleague is a real route. The record's KEV flag is false.
Quick check
Which versions fix it?
9.0.20.238 for the 9.0.20 branch and 9.0.21.201 for the 9.0.21 branch.
Are there related Control-M CVEs?
Yes. CVE-2024-1604 and CVE-2024-1606 are in the same advisory.
Sources
Last reviewed: 19 October 2026.
