CVE-2024-7847 Overview
CVE-2024-7847 affects Rockwell Automation RSLogix programming software used to develop control logic for PLCs in industrial environments. The vulnerability stems from insufficient verification of data authenticity [CWE-345] when handling RSP/RSS project files. Attackers can craft a project file containing an embedded Visual Basic for Applications (VBA) script configured to execute automatically when the file opens. Opening a malicious project file triggers arbitrary code execution in the context of the authenticated engineering workstation user. Connected industrial devices reachable from the workstation may also be impacted after exploitation.
Critical Impact
Successful exploitation grants remote code execution on engineering workstations and can pivot to connected PLCs and OT assets.
Affected Products
- Rockwell Automation RSLogix 5
- Rockwell Automation RSLogix 500
- Rockwell Automation RSLogix Micro Developer and Micro Starter Lite
Discovery Timeline
- Vulnerability reported to Rockwell Automation by Sharon Brizinov of Claroty Research - Team82
- 2024-10-14 - CVE-2024-7847 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7847
Vulnerability Analysis
RSLogix project files (RSP/RSS) support embedding VBA scripts that can be configured to run automatically on file open. The software does not adequately validate the authenticity or origin of the embedded script before execution. An attacker weaponizes a project file by embedding malicious VBA and setting the auto-execute property. When a legitimate engineer opens the file, the script runs with the engineer's privileges on the workstation. This class of issue maps to [CWE-345: Insufficient Verification of Data Authenticity].
Root Cause
The root cause is a design decision to permit auto-execution of user-supplied VBA content embedded in project files without integrity verification, digital signature checks, or a trust prompt. RSLogix treats the project file as trusted input, so any code carried inside inherits that trust at open time.
Attack Vector
Exploitation requires user interaction: an engineer must open a project file delivered through phishing, a compromised file share, a supplier handoff, or removable media. The attack vector is local to the engineering workstation. Once code executes, an attacker can access controllers reachable from that workstation over industrial protocols and manipulate downstream OT devices.
No verified proof-of-concept code is publicly available. See the Rockwell Automation Security Advisory SD1701 for vendor technical details.
Detection Methods for CVE-2024-7847
Indicators of Compromise
- RSP or RSS project files received from untrusted, external, or unverified sources, particularly those transferred via email, USB media, or non-corporate file shares.
- Unexpected child processes spawned by RSLogix executables, including cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- Outbound network connections from engineering workstations to unknown hosts immediately following an RSLogix project file open event.
Detection Strategies
- Monitor process lineage on engineering workstations for RSLogix processes launching scripting interpreters or LOLBins.
- Alert on file writes to Startup, Run registry keys, or scheduled task creation shortly after RSLogix launches a project file.
- Correlate project file open events with anomalous network activity toward PLCs, historians, or external IP addresses.
Monitoring Recommendations
- Enable command-line and process-creation logging (Windows Event ID 4688, Sysmon Event ID 1) on all engineering workstations running RSLogix.
- Baseline normal RSLogix behavior and alert on deviations such as VBA macro execution or embedded object activation.
- Forward workstation and OT DMZ telemetry to a central SIEM to enable cross-domain correlation with controller activity.
How to Mitigate CVE-2024-7847
Immediate Actions Required
- Apply the vendor-provided update as directed in Rockwell Automation Security Advisory SD1701.
- Restrict RSLogix installations to hardened engineering workstations and remove the software from general-purpose endpoints.
- Only open project files originating from trusted, verified sources and validated through an integrity check.
Patch Information
Rockwell Automation published remediation guidance in Security Advisory SD1701. Administrators should review the advisory for the current fixed versions of RSLogix 5, RSLogix 500, RSLogix Micro Developer, and RSLogix Micro Starter Lite, and deploy the updates across all engineering workstations.
Workarounds
- Segment engineering workstations from corporate IT networks and enforce strict allow-listing for OT protocol traffic.
- Scan inbound RSP/RSS files in a sandbox before delivery to engineers and block delivery of project files over email.
- Apply application allow-listing on engineering workstations to prevent RSLogix from spawning unauthorized child processes such as script interpreters.
# Example: Windows AppLocker rule to block script interpreters spawned by RSLogix
# Review, adapt paths, and test in audit mode before enforcement
New-AppLockerPolicy -RuleType Path -User Everyone \
-RuleNamePrefix "Block-RSLogix-Scripting" \
-Path "%SYSTEM32%\wscript.exe","%SYSTEM32%\cscript.exe","%SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe" \
-Action Deny
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
