How severe is CVE-2024-9412?

CVE-2024-9412 has a CVSS 4.0 base score of 8.4, rated high severity.

Is CVE-2024-9412 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-9412?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-9412 have an EU (EUVD) identifier?

Yes. CVE-2024-9412 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49924.

When was CVE-2024-9412 published?

CVE-2024-9412 was published on 2024-10-08 and last updated on 2026-06-17.

CVE-2024-9412

CVE-2024-9412 is a high-severity vulnerability with a CVSS 4.0 base score of 8.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-842.

Key facts

Severity: High (CVSS 4.0 base score 8.4)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-49924
Weakness: CWE-842
Published: 2024-10-08
Last modified: 2026-06-17

Description

An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.

Frequently asked questions

What is CVE-2024-9412?: An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.
How severe is CVE-2024-9412?: CVE-2024-9412 has a CVSS 4.0 base score of 8.4, rated high severity.
Is CVE-2024-9412 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-9412?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-9412 have an EU (EUVD) identifier?: Yes. CVE-2024-9412 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49924.
When was CVE-2024-9412 published?: CVE-2024-9412 was published on 2024-10-08 and last updated on 2026-06-17.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html

Other CWE-842 vulnerabilities

CVE-2022-3650 — High (CVSS 7.8): A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to…
CVE-2026-6970 — High (CVSS 7.3): authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege…
CVE-2022-2990 — High (CVSS 7.1): An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive…
CVE-2022-2989 — High (CVSS 7.1): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive…
CVE-2022-45097 — Medium (CVSS 6.3): Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network…
CVE-2022-31007 — Medium (CVSS 4.9): eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an…

Browse all CWE-842 vulnerabilities →