CVE-2024-8533

2024-09-1220:15:05

CWE-269

CWE-276

[email protected]

web.nvd.nist.gov

privilege escalation

rockwell automation

default file permissions

exfiltrate credentials

escalate privileges

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

20.0%

JSON

A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions allowing users to exfiltrate credentials and escalate privileges.

Affected configurations

Nvd

Node

rockwellautomation2800c_optixpanel_compact_firmwareRange4.0.0.325–4.0.2.116

AND

rockwellautomation2800c_optixpanel_compactMatch-

Node

rockwellautomation2800s_optixpanel_standard_firmwareRange4.0.0.350–4.0.2.123

AND

rockwellautomation2800s_optixpanel_standardMatch-

Node

rockwellautomationembedded_edge_compute_module_firmwareRange4.0.0.347–4.0.2.106

AND

rockwellautomationembedded_edge_compute_moduleMatch-

VendorProductVersionCPE
rockwellautomation2800c_optixpanel_compact_firmware*cpe:2.3:o:rockwellautomation:2800c_optixpanel_compact_firmware:*:*:*:*:*:*:*:*
rockwellautomation2800c_optixpanel_compact-cpe:2.3:h:rockwellautomation:2800c_optixpanel_compact:-:*:*:*:*:*:*:*
rockwellautomation2800s_optixpanel_standard_firmware*cpe:2.3:o:rockwellautomation:2800s_optixpanel_standard_firmware:*:*:*:*:*:*:*:*
rockwellautomation2800s_optixpanel_standard-cpe:2.3:h:rockwellautomation:2800s_optixpanel_standard:-:*:*:*:*:*:*:*
rockwellautomationembedded_edge_compute_module_firmware*cpe:2.3:o:rockwellautomation:embedded_edge_compute_module_firmware:*:*:*:*:*:*:*:*
rockwellautomationembedded_edge_compute_module-cpe:2.3:h:rockwellautomation:embedded_edge_compute_module:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	2800c_optixpanel_compact_firmware	*	cpe:2.3:o:rockwellautomation:2800c_optixpanel_compact_firmware::::::::
rockwellautomation	2800c_optixpanel_compact	-	cpe:2.3:h:rockwellautomation:2800c_optixpanel_compact:-:::::::*
rockwellautomation	2800s_optixpanel_standard_firmware	*	cpe:2.3:o:rockwellautomation:2800s_optixpanel_standard_firmware::::::::
rockwellautomation	2800s_optixpanel_standard	-	cpe:2.3:h:rockwellautomation:2800s_optixpanel_standard:-:::::::*
rockwellautomation	embedded_edge_compute_module_firmware	*	cpe:2.3:o:rockwellautomation:embedded_edge_compute_module_firmware::::::::
rockwellautomation	embedded_edge_compute_module	-	cpe:2.3:h:rockwellautomation:embedded_edge_compute_module:-:::::::*