RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention. This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rockwell | RSLogix 500® | All | — | No fix listed | CNA |
| Rockwell | RSLogix™ Micro Developer and Starter | All | — | No fix listed | CNA |
| Rockwell | RSLogix™ 5 | All | — | No fix listed | CNA |
- RSLogix 500® VendorRockwell Affected All Fixed in — No fix listed CNA
- RSLogix™ Micro Developer and Starter VendorRockwell Affected All Fixed in — No fix listed CNA
- RSLogix™ 5 VendorRockwell Affected All Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rockwellautomation:rslogix_5:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:rslogix_500:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:rslogix_micro_developer:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:rslogix_micro_starter_lite:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
- cpe:2.3:a:rockwellautomation:rslogix_5:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:rslogix_500:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:rslogix_micro_developer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:rslogix_micro_starter_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7847
- 2026-10-03 Alias added: GHSA-wr43-q2v2-949w
References
Sources
- CVE-2024-7847 · CVE Program
- CVE-2024-7847 · NVD
- FIRST EPSS
- GHSA-wr43-q2v2-949w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences