How severe is CVE-2024-21866?

CVE-2024-21866 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-21866 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-21866?

CVE-2024-21866 affects Rapidscada Rapid Scada. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-21866?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-21866 have an EU (EUVD) identifier?

Yes. CVE-2024-21866 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19477.

When was CVE-2024-21866 published?

CVE-2024-21866 was published on 2024-02-02 and last updated on 2026-06-17.

CVE-2024-21866

CVE-2024-21866 is a medium-severity vulnerability in Rapidscada Rapid Scada with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-209.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19477
Weakness: CWE-209
Affected product: Rapidscada Rapid Scada
Published: 2024-02-02
Last modified: 2026-06-17

Description

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.

Frequently asked questions

What is CVE-2024-21866?: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.
How severe is CVE-2024-21866?: CVE-2024-21866 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-21866 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-21866?: CVE-2024-21866 affects Rapidscada Rapid Scada. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-21866?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-21866 have an EU (EUVD) identifier?: Yes. CVE-2024-21866 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19477.
When was CVE-2024-21866 published?: CVE-2024-21866 was published on 2024-02-02 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:rapidscada:rapid_scada:*:*:*:*:*:*:*:*

More vulnerabilities in Rapidscada Rapid Scada

CVE-2024-21764 — Critical (CVSS 9.8): In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which…
CVE-2024-21852 — High (CVSS 8.8): In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration…
CVE-2024-22016 — High (CVSS 7.8): In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the…
CVE-2020-22722 — High (CVSS 7.8): Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe…
CVE-2018-5313 — High (CVSS 7.8): A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions.…
CVE-2024-47221 — High (CVSS 7.5): CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.

All CVEs affecting Rapidscada Rapid Scada →

Other CWE-209 (Generation of Error Message Containing Sensitive Information) vulnerabilities

CVE-2025-62168 — Critical (CVSS 10.0): Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication…
CVE-2025-68110 — Critical (CVSS 9.9): ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an…
CVE-2025-46658 — Critical (CVSS 9.8): An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.
CVE-2024-28285 — Critical (CVSS 9.8): A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows…
CVE-2023-40767 — Critical (CVSS 9.8): User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where…
CVE-2023-40766 — Critical (CVSS 9.8): User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery,…

Browse all CWE-209 (Generation of Error Message Containing Sensitive Information) vulnerabilities →