DLL side-loading in a corporate VPN client

Summary

The client’s update service also searches a user-writable directory for the library it loads. An attacker can drop a malicious DLL there and run code as SYSTEM.

Impact

An attacker with local access gains full privileges on the endpoint.

Recommendation

Deploy the current client version and use application allow-listing.