CVE-2024-7847 is a high severity flaw in Rockwell Automation RSLogix 5, RSLogix 500 and RSLogix Micro Developer. A project file can carry an embedded VBA script that runs on open. Rockwell lists no corrected version, so the defense is configuration: deny VBA, use trusted locations and verify files.
What's affected
According to Rockwell advisory SD1701, the affected products are RSLogix 500, RSLogix Micro Developer and Starter, and RSLogix 5. The advisory lists all software versions as affected and shows no corrected version. The advisory header also says Corrected: No and Workaround: Yes.
The CVE-2024-7847 record gives a CVSS 3.1 score of 7.7 (vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). The advisory publishes a second score, CVSS 4.0 at 8.8 out of 10. Both are high. Rockwell marks the Known Exploited Vulnerability field as No, and the record's KEV flag is false.
Dates differ a little between sources. The NVD record shows 14 October 2024, while the advisory shows a published date of 16 September 2024 in its header and 19 September 2024 in its summary, with a last update of 14 October 2024. We use the record's date for this post and the advisory for everything else.
How to check if you're exposed
Exposure here is about where the software is installed and who opens project files.
- List workstations that have RSLogix 5, RSLogix 500 or RSLogix Micro installed, including engineering laptops and any shared jump hosts.
- Check whether VBA execution is allowed. Rockwell points to the Enable/Disable VBA policy in FactoryTalk Administration Console, under Policies.
- Ask where RSP and RSS project files come from. Files from email, vendor shares, integrators and removable media all count.
The advisory does not provide a scanner or a version check, because every version is in scope.
What to do now
- Deny VBA execution where you do not need it. In FactoryTalk Administration Console, go to Policies, select Enable/Disable VBA, and check the Deny box.
- Save project files in a Trusted location where only administrators can modify them, and verify file integrity.
- Use the VBA editor protection feature, which locks the VBA code from viewing and editing with a password.
- Treat project files from outside your organization as untrusted until you have inspected them in a controlled environment.
- Watch the Rockwell advisory for a corrected version, since none is listed at the time of this review.
Why it matters
The record classifies the weakness as CWE-345, insufficient verification of data authenticity. The software has a feature that lets a project file include a VBA script and run it on open without user intervention. If the software cannot tell a trustworthy script from a planted one, a person who simply opens a file becomes the trigger.
Rockwell notes that connected devices may also be impacted, which is why this matters beyond one PC. Engineering workstations talk to controllers. The advisory credits Sharon Brizinov of Claroty Research, Team82, with reporting it.
There is no patch to wait for here, so the lasting fix is policy: restrict where project files come from, and keep a record of which machines hold the software. For a wider view of this class of work, see how a dependency inventory turns a scattered estate into a list you can act on.
Quick check
Is there a fixed version of RSLogix for CVE-2024-7847?
Not in the advisory we read. Rockwell lists all versions as affected, no corrected version, and recommends the mitigations above.
Do the CVSS scores disagree?
They are two scoring systems. The record carries CVSS 3.1 at 7.7, and Rockwell also publishes CVSS 4.0 at 8.8. Both rate it high.
Sources
Last reviewed: 19 October 2026.
