PT-2024-6333 · Rockwell Automation · Rslogix 5

Sharon Brizinov · Published 2024-09-19 · Updated 2024-10-19 · CVE-2024-7847

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSLogix 5 (affected versions not specified)

Description A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention. This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2024-07285

CVE-2024-7847

Affected Products

Rslogix 5

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-7847 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07285 · Security Note
• https://t.me/cvenotify/97992 · Telegram Post
• https://twitter.com/CveFindCom/status/1845827210118144383 · Twitter Post
• https://twitter.com/oktsec/status/1845866713155346714 · Twitter Post
• https://t.me/cvedetector/7806 · Telegram Post
• https://twitter.com/cracbot/status/1846793362789355537 · Twitter Post
• https://t.me/latest_high_impact_cve/1322 · Telegram Post
• https://twitter.com/CVEnew/status/1845830973813899770 · Twitter Post
• https://twitter.com/SecuriTricks/status/1845842538839613923 · Twitter Post
• https://twitter.com/cracbot/status/1847518101207994408 · Twitter Post