Vulnerability in Rockwell Automation Pavilion8®
CVE-2024-6435
A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. For example, a malicious user with basic privileges could perform critical functions such as creating a user with elevated privileges and reading sensitive information in the “views” section.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (39.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 39.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Rockwell Automation Pavilion8® — versions 5.15.00, 5.15.01, 5.16.00
- Rockwellautomation Pavilion8 — versions 5.15.00, 5.15.01, 5.16.00
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-6435?
- CVE-2024-6435 is a high-severity vulnerability in Rockwell Automation Pavilion8®, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2024-07-16.
- How severe is CVE-2024-6435?
- High severity. CVSS v3 base score is 8.8 out of 10.