PT-2024-6591 · Rockwell Automation · Embedded Edge Compute Module+2

Published 2024-09-12 · Updated 2024-09-19 · CVE-2024-8533

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Rockwell Automation products (affected versions not specified)

Description: A privilege escalation issue exists due to improper default file permissions, allowing users to exfiltrate credentials and escalate privileges. This can be exploited by a remote attacker to gain user credentials and increase their privileges. The issue affects the management of graphical user interface software on industrial devices, including the Rockwell Automation 2800C OptixPanel Compact, 2800S OptixPanel Standard, and the Embedded Edge Compute Module.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

BDU:2024-07737

CVE-2024-8533

Affected Products

Embedded Edge Compute Module

Rockwell Automation 2800C Optixpanel Compact

Rockwell Automation 2800S Optixpanel Standard

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-8533 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1964.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07737 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8533 · Vendor Advisory
• https://twitter.com/CVEnew/status/1834325369890947580 · Twitter Post
• https://t.me/cvenotify/95188 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1834300439447130476 · Twitter Post
• https://t.me/cvedetector/5524 · Telegram Post