VulnerabilityDeferred

CVE-2024-9412

An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in.

HIGH 8.4EPSS 0.41%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.

CVSS 4.0: 8.4 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.41% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-842
Source: PSIRT@rockwellautomation.com

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.