CVE-2024-21869
published 2024-02-02CVE-2024-21869: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an…
PriorityP426medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.16%
5.6th percentile
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rapid_software_llc | rapid_scada | <= 5.8.4 | — |
| rapidscada | rapid_scada | <= 5.8.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Rapid Software LLC Rapid SCADA
cisa_ics·2024-01-11·CVSS 8.8
[HIGH] Rapid Software LLC Rapid SCADA
ICS Advisory
##
Rapid Software LLC Rapid SCADA
Release DateJanuary 11, 2024
Alert CodeICSA-24-011-03
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.6
- ATTENTION: Exploitable remotely, low attack complexity
- Vendor: Rapid Software LLC
- Equipment: Rapid SCADA
- Vulnerabilities: Path Traversal, Relative Path Traversal, Local Privilege Escalation through Incorrect Permission Assignment for Critical Resource, Open Redirect, Use of Hard-coded Credentials, Plaintext Storage of a Password, Generation of Error Message Containing Sensitive Information
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in an attacker reading sensitive files from the Rapid Scada server, writing files to the Rapid Scada directory (thus achieving code
GHSA
GHSA-pvj2-qwhc-2m88: In Rapid Software LLC's Rapid SCADA versions prior to Version 5
ghsa_unreviewed·2024-02-02
CVE-2024-21869 [MEDIUM] CWE-256 GHSA-pvj2-qwhc-2m88: In Rapid Software LLC's Rapid SCADA versions prior to Version 5
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-02
Published