High severity · published Oct 8, 2024
CVE-2024-9412
Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager
8.4
CVSS
0.4%
EPSS
No
On KEV
Description
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Verve® Asset Manager · Rockwell Automation
All versions < 1.38 · source: vendor
VA
Verve Asset Manager · Rockwellautomation
before 1.38 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9412
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html
More from Verve® Asset Manager
8.8
CVE-2025-14377
Verve Asset Manager – Plaintext Storage Vulnerabilities
8.6
CVE-2025-14376
Verve Asset Manager – Plaintext Storage Vulnerabilities
8.4
CVE-2025-11862
Verve Asset Manager Access Control Vulnerability
7.5
CVE-2025-1449
Admin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager