CVE-2024-7847
highPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.002 · 8. PerzentilEURUUSEPSS · bewertet 2026-10-27
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention. This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationRSLogix 5cisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
- MitigationRSLogix 500cisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
- MitigationRSLogix Micro Developer and Startercisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–8.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
- rockwellautomation rslogix 5alle VersionennvdUScpe:2.3:a:rockwellautomation:rslogix_5:*:*:*:*:*:*:*:*
- rockwellautomation rslogix 500alle VersionennvdUScpe:2.3:a:rockwellautomation:rslogix_500:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro developeralle VersionennvdUScpe:2.3:a:rockwellautomation:rslogix_micro_developer:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro starter litealle VersionennvdUScpe:2.3:a:rockwellautomation:rslogix_micro_starter_lite:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-24-263-01Rockwell Automation RSLogix 5 and RSLogix 5002024-09-19icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to perform remote code execution.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-7847/cnnvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlcnnvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlenisa_euvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan