SYSTEM code execution via uncontrolled DLL search

Privilege escalation in Cisco Meraki Systems Manager Agent for Windows before 4.2.0 allows local users to execute code as SYSTEM. At startup, the agent searches attacker-writable directories for configuration and DLL files, then reads the configuration and loads the planted library. A low-privileged user must plant both files locally and wait for agent startup, after which the malicious DLL runs with SYSTEM privileges.