CVE-2024-7953: Vulnerability in Rockwell Automation DataEdgePlatform DataMosaix™ Private Cloud

This vulnerability (CVE-2024-7953) in Rockwell Automation's DataEdgePlatform DataMosaix™ Private Cloud allows an attacker with limited privileges to create a project and escalate their privileges to become the administrator of that project. As an administrator of their own project, the attacker can create, modify, and delete project content, potentially impacting the integrity and availability of project data. The vulnerability is identified as CWE-284 (Improper Access Control) and affects all versions up to and including 7.07. The CVSS 4.0 score is 8.7, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker can gain administrative control over a project they create, allowing them to create, modify, and delete project data. This could lead to unauthorized changes or deletion of project information, potentially disrupting operations or causing data loss within the affected platform. The vulnerability impacts confidentiality, integrity, and availability of project data within the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected platform to trusted users only and monitor for unauthorized project creation or modification activities. Follow Rockwell Automation's official channels for updates on patches or mitigations.