CVE-2024-6435 is a high severity (CVSS 8.8) privilege escalation flaw in Rockwell Automation Pavilion8. A user with basic rights can call functions meant for administrators, including creating users. Rockwell lists v5.20.00 and v6.0 as the corrected releases.
What's affected
Rockwell advisory SD1681, published 16 July 2024, lists these versions as affected: v5.15.00, v5.15.01, v5.16.00, v5.17.00 and v5.17.01. The corrected versions it names are v5.20.00 and v6.0. The NVD record lists the first three as affected products.
The advisory states that Rockwell found the issue internally during routine testing. It marks the flaw as not in the KEV catalog, and says no workaround exists beyond upgrading and applying security best practices.
On scoring, the two sources agree. NVD gives CVSS 3.1 of 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Rockwell gives 8.8 for CVSS 3.1 and also publishes 8.7 under CVSS 4.0. The weakness is CWE-732, incorrect permission assignment for a critical resource.
How to check if you're exposed
- Open the Pavilion8 version information in your installation and compare it with the list above.
- Remember that the advisory lists versions "first known" and "corrected in", so a build between the listed versions needs a check with Rockwell.
- List every account with basic privileges. Those are the accounts that matter for this flaw.
- Review the user list for recently created accounts you do not recognise, and check the "views" section for unexpected access, since the advisory gives reading it as an example impact.
What to do now
- Plan an upgrade to v5.20.00 or v6.0, whichever your support agreement and plant calendar allow.
- Until then, follow Rockwell's guidance: limit access to only those who need it, and review user access and privileges on a schedule.
- Audit existing administrator accounts and delete any you cannot tie to a person.
- Restrict network access to the Pavilion8 server to the engineering and operations networks that use it.
- Keep a record of the review for your next audit.
Why it matters
A user who can create an elevated account has turned a small foothold into full control of the application, and can read operational data on the way.
The cause is a permission mistake: functions that should check for an administrator role can be reached with a lower one. Fixing it means enforcing the role check on the server for every administrative action.
Quick check
Is there a workaround if I cannot upgrade?
Rockwell lists no specific workaround. It asks users to apply security best practices such as limiting access to those who need it and reviewing privileges periodically.
Is this exploited in the wild?
The Rockwell advisory marks it as not in the KEV database, and the NVD record has KEV set to false.
Sources
Last reviewed: 19 October 2026.
