Rockwellautomation PAVILION8 vulnerabilities

5 CVEs affecting Rockwellautomation PAVILION8, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-7961, published 2024-09-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-29463, published 2023-09-12. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other…
CVE-2024-7961, published 2024-09-12. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server that could result in a remote code…
CVE-2024-6435, published 2024-07-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with…
CVE-2024-7960, published 2024-09-12. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect…
CVE-2024-40620, published 2024-08-14. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the…