CVE-2024-7960: Rockwell Automation Incorrect Privileges and Path Traversal Vulnerability in Pavilion8®

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-12 · updated 2026-06-17
Weakness: CWE-269

Description

The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect privilege matrix that allows users to have access to functions they should not.

Affected products

Rockwell Automation Pavilion8®: before 6.0 — fixed in 6.0

How to fix

Upgrade to a fixed version: Rockwell Automation Pavilion8® 6.0. Check the vendor advisory for mitigations.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1695.html

Get alerted when CVE-2024-7960 or the next vulnerability affects your stack