Skip to main content

Open Automation Software CVE-2024-11220

HIGH
Incorrect Execution-Assigned Permissions (CWE-279)
2024-12-06 ics-cert@hq.dhs.gov
Privilege Escalation Open Automation Software
8.5
CVSS 4.0 · Vendor: hq
Share

Severity by source

Vendor (hq) PRIMARY
8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Dec 06, 2024 - 18:15 cve.org
HIGH 8.5

DescriptionCVE.org

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

AnalysisAI

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-279. A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation. Affected products include: Openautomationsoftware Open Automation Software.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Open Automation Software

View all
CVE-2024-27201 MEDIUM POC
4.9 Apr 03

An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation

CVE-2024-24976 MEDIUM POC
4.9 Apr 03

A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automati
CVE-2024-22178 MEDIUM POC
4.9 Apr 03

A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Softwar
CVE-2024-21870 MEDIUM POC
4.9 Apr 03

A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Pla

Same weakness CWE-279 – Incorrect Execution-Assigned Permissions

View all
CVE-2024-37734 CRITICAL POC
9.8
CVE-2020-8025 CRITICAL POC
9.3
CVE-2023-4383 HIGH POC
7.8
CVE-2023-4665 HIGH
8.8
CVE-2025-22843 HIGH
8.8
CVE-2025-14025 HIGH
8.5
CVE-2026-20062 HIGH
7.2
CVE-2023-3915 HIGH
7.2

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2024-11220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy