Vulnerability · Published Jul 16, 2024 · Assigned by Rockwell
CVE-2024-6435Rockwell Automation Privilege Escalation Vulnerability in Pavilion8®
High 8.7
In plain English
A high-severity incorrect permission assignment in Pavilion8® from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. For example, a malicious user with basic privileges could perform critical functions such as creating a user with elevated privileges and reading sensitive information in the “views” section.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Pavilion8® | 5.15.005.15.015.16.005.17.005.17.015.20.00 |
Weakness: CWE-732 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N