CVE-2024-7847
highpriority · track · 31OT risk · elevatedEPSS 0.002 · 8 %ileEURUUSEPSS · scored 2026-10-27
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention. This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationRSLogix 5cisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
- MitigationRSLogix 500cisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
- MitigationRSLogix Micro Developer and Startercisa_csaf_ot
Deny the execution feature in FactoryTalk Administration Console, when not needed, by navigating to "Policies", selecting ‘"Enable/Disable VBA", and then checking the "Deny" box to block VBA code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
- rockwellautomation rslogix 500all versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_500:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro developerall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_micro_developer:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro starter liteall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_micro_starter_lite:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-24-263-01Rockwell Automation RSLogix 5 and RSLogix 5002024-09-19icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to perform remote code execution.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-7847/cnnvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlcnnvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlenisa_euvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan