PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-7961 Rockwell Automation CVE debrief

A path traversal vulnerability in Rockwell Automation Pavilion8 versions prior to V5.20 allows authenticated attackers with high privileges to upload arbitrary files to the server, potentially resulting in remote code execution. The vulnerability was disclosed by CISA on September 12, 2024, with a CVSS 3.1 score of 7.2 (HIGH). The attack vector is network-based with low attack complexity, requiring high privileges but no user interaction. Rockwell Automation has released version V6.0 and later to address this issue. Organizations unable to upgrade should apply security best practices and consult Rockwell Automation's security advisory page for additional mitigation guidance.

Vendor
Rockwell Automation
Product
Pavilion8
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-12
Original CVE updated
2024-09-12
Advisory published
2024-09-12
Advisory updated
2024-09-12

Who should care

Organizations operating Rockwell Automation Pavilion8 industrial control systems, particularly those in manufacturing and process industries. System administrators, OT security teams, and asset owners responsible for maintaining Pavilion8 deployments should prioritize patching or implementing compensating controls.

Technical summary

CVE-2024-7961 is a path traversal vulnerability in Rockwell Automation Pavilion8 versions prior to V5.20. The vulnerability allows an authenticated attacker with high privileges to upload arbitrary files to the server through improper path validation. Successful exploitation could lead to remote code execution on the affected system. The vulnerability has a CVSS 3.1 base score of 7.2 (HIGH) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Rockwell Automation has addressed this in version V6.0 and later.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Pavilion8 to version V6.0 or later per vendor guidance
  • If immediate upgrade is not feasible, apply CISA ICS recommended security best practices
  • Review and restrict administrative access to Pavilion8 systems
  • Monitor for unauthorized file uploads or unexpected file system changes
  • Consult Rockwell Automation security advisories for additional mitigation measures

Evidence notes

CISA ICS Advisory ICSA-24-256-24 published 2024-09-12 identifies path traversal in Pavilion8 <V5.20 with CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Vendor fix available in V6.0 and later.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-7961 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-7961

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-7961 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-7961

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-24.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-24

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.