Vulnerability · Published Sep 12, 2024 · Assigned by Rockwell
CVE-2024-7960Rockwell Automation Incorrect Privileges and Path Traversal Vulnerability in Pavilion8®
High 8.8
In plain English
A high-severity privilege mismanagement in Pavilion8® from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Severity (CVSS 4.0)8.8High
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect privilege matrix that allows users to have access to functions they should not.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Pavilion8® | <V5.20 |
Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N