CVE-2024-40620

HIGH

Rockwell Automation Pavilion8 - Missing Encryption of Sensitive Data

Title source: llm

Description

CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.

References (1)

Core 1

Core References

Vendor Advisory

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201691.html

Scores

CVSS v3 7.5

EPSS 0.0019

EPSS Percentile 8.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-311

Status published

Products (1)

rockwellautomation/pavilion8 5.20.00

Published Aug 14, 2024

Tracked Since Feb 18, 2026