{"id":"CVE-2024-7847","aliases":["EUVD-2024-48698","GHSA-wr43-q2v2-949w"],"status":"published","title":"RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script","description":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. \n\nA feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00185,"percentile":0.08183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2024-10-14T13:47:14Z","modified":"2026-06-17T08:21:02Z","products":[{"vendor":"rockwell automation","product":"rslogix 500®"},{"vendor":"rockwell automation","product":"rslogix™ 5"},{"vendor":"rockwell automation","product":"rslogix™ micro developer and starter"},{"vendor":"rockwellautomation","product":"rslogix_5"},{"vendor":"rockwellautomation","product":"rslogix_500"},{"vendor":"rockwellautomation","product":"rslogix_micro_developer"},{"vendor":"rockwellautomation","product":"rslogix_micro_starter"},{"vendor":"rockwellautomation","product":"rslogix_micro_starter_lite"}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7847"},{"url":"https://github.com/advisories/GHSA-wr43-q2v2-949w"}],"sources":{"cve":[{"id":"CVE-2024-7847","title":"RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script","description":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. \n\nA feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.","status":"published","published":"2024-10-14T13:47:14.54Z","modified":"2024-10-15T14:05:45.67Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-48698","description":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. \n\nA feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.","status":"published","published":"2024-10-14T13:47:14Z","modified":"2024-10-15T14:05:45Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-03T00:27:37.250145Z"}],"ghsa":[{"id":"GHSA-wr43-q2v2-949w","title":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to...","description":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. \n\nA feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.","status":"published","published":"2024-10-14T15:30:45Z","modified":"2024-10-14T15:30:54Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:58:29.701719Z"}],"nvd":[{"id":"CVE-2024-7847","description":"VULNERABILITY DETAILS\n\nRockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. \n\nA feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.","status":"published","published":"2024-10-14T14:15:12.02Z","modified":"2026-06-17T08:21:02.193Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:10:31.879321Z"}]}}