CVE-2024-21852

Summary

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerability in the unpacking routine to achieve remote code execution.

Affected Software

Weaknesses

• CWE-22: CWE-22 Path Traversal

Workarounds

Rapid Software did not respond to CISA's attempts at coordination. Users of Rapid SCADA are encouraged to contact Rapid Software and keep their systems up to date.

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03
• https://rapidscada.org/contact/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03
• https://rapidscada.org/contact/

• ←Previous
• Next→