CVE-2024-10930 Overview
CVE-2024-10930 is an Uncontrolled Search Path Element vulnerability [CWE-427] in Carrier Block Load. The flaw allows a local attacker to perform DLL hijacking and execute arbitrary code with escalated privileges. Carrier Block Load is a heating, ventilation, and air-conditioning (HVAC) load calculation application used in building systems engineering. CISA published the issue under ICS advisory ICSA-25-063-01, categorizing it as an industrial control system (ICS) risk.
Exploitation requires local access and user interaction, such as launching the application from a directory that contains an attacker-supplied library. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.
Critical Impact
A local attacker who places a malicious DLL in an untrusted search path can hijack Block Load's library loading process and run code with the privileges of the invoking user.
Affected Products
- Carrier Block Load (all versions up to and including 4.00)
- Carrier Block Load 4.00
- Windows workstations running Carrier Block Load in engineering environments
Discovery Timeline
- 2025-03-04 - CVE-2024-10930 published to NVD
- 2025-03-04 - CISA releases ICS advisory ICSA-25-063-01
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10930
Vulnerability Analysis
Carrier Block Load loads dynamic-link libraries without fully qualifying their paths. Windows resolves unqualified library names using a search order that includes the application's current working directory. When a user launches Block Load from a directory that an attacker controls, Windows locates the attacker's DLL before the legitimate system copy.
The attacker's code then executes inside the Block Load process. Because engineering workstations frequently run Block Load under privileged accounts, the injected code inherits those privileges. The vulnerability maps to CWE-427: Uncontrolled Search Path Element.
Refer to the CISA ICS Advisory ICSA-25-063-01 for the authoritative technical description.
Root Cause
The application resolves DLL dependencies through Windows' default search order rather than binding to absolute paths or calling SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32. This behavior allows a library placed alongside a project file or launcher shortcut to preempt the legitimate module.
Attack Vector
An attacker plants a crafted DLL, matching the name of a library that Block Load loads at startup, into a directory that a target user will open. The user then double-clicks a Block Load project file or the executable from that directory. Block Load loads the malicious DLL, and its DllMain runs arbitrary code in the process. Delivery vectors include phishing attachments, shared network folders, and removable media used in operational technology (OT) environments.
No verified proof-of-concept code is publicly available. See the vendor and CISA advisories for further exploitation context.
Detection Methods for CVE-2024-10930
Indicators of Compromise
- Unexpected .dll files residing in user directories, project folders, or removable media that also contain Block Load project files
- Block Load.exe loading modules from non-standard paths such as %USERPROFILE%\Downloads or network shares
- Child processes spawned by Block Load that are inconsistent with normal HVAC engineering workflows, for example cmd.exe, powershell.exe, or rundll32.exe
Detection Strategies
- Enumerate module loads for the Block Load process and alert on DLLs whose paths fall outside Program Files or System32
- Correlate Sysmon Event ID 7 (Image Loaded) with Event ID 1 (Process Create) to detect side-loading patterns during Block Load startup
- Hunt for writes of .dll files into directories that also contain Block Load project extensions
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction rules that block untrusted DLL loads from user-writable locations
- Forward endpoint telemetry from engineering workstations into a centralized data lake to preserve module-load history for retrospective hunts
- Baseline the expected DLL set for Block Load and alert on any deviation
How to Mitigate CVE-2024-10930
Immediate Actions Required
- Restrict launching Block Load to a dedicated, access-controlled installation directory and disable execution from user-writable paths
- Apply Windows AppLocker or Windows Defender Application Control policies that limit DLL loading to signed, vendor-approved binaries
- Segment engineering workstations that host Block Load from general-purpose corporate networks per CISA ICS defense-in-depth guidance
Patch Information
Consult the Carrier Product Security Advisory and CISA ICS Advisory ICSA-25-063-01 for the current fixed version and vendor guidance. Upgrade Block Load to the remediated release identified by Carrier for versions at or below 4.00.
Workarounds
- Instruct users to open Block Load only from its installed program directory, never by double-clicking project files from email, downloads, or removable media
- Remove write permissions from directories that contain Block Load executables and required libraries
- Set the registry value HKLM\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDllSearch to 0xFFFFFFFF to remove the current working directory from the DLL search path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
