CVE-2024-6242
CVE-2024-6242 is a high-severity vulnerability with a CVSS 4.0 base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-420.
Key facts
- Severity: High (CVSS 4.0 base score 7.3)
- EPSS exploit prediction: 9% (95th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-47370
- Weakness: CWE-420
- Published:
- Last modified:
Description
A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
Frequently asked questions
- What is CVE-2024-6242?
- A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
- How severe is CVE-2024-6242?
- CVE-2024-6242 has a CVSS 4.0 base score of 7.3, rated high severity.
- Is CVE-2024-6242 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2024-6242?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-6242 have an EU (EUVD) identifier?
- Yes. CVE-2024-6242 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47370.
- When was CVE-2024-6242 published?
- CVE-2024-6242 was published on 2024-08-01 and last updated on 2026-06-17.
References
Other CWE-420 vulnerabilities
- CVE-2023-20198 — Critical (CVSS 10.0): Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco…
- CVE-2025-52921 — Critical (CVSS 9.9): In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to…
- CVE-2025-13315 — Critical (CVSS 9.8): Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can…
- CVE-2025-54309 — Critical (CVSS 9.0): CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation…
- CVE-2025-54351 — High (CVSS 8.9): In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
- CVE-2026-40217 — High (CVSS 8.8): LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the…