CVE-2024-21869

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256 CWE-522

Affected software

Vendor	Product	Versions
Rapid Software LLC	Rapid SCADA	<= 5.8.4

References

https://rapidscada.org/contact/Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03Third Party Advisory, US Government Resource
https://rapidscada.org/contact/Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03Third Party Advisory, US Government Resource

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-21875.4The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all ver CVE-2024-218704.9A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A CVE-2024-218717.5Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv CVE-2024-218727.5The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critic CVE-2024-218756.5Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 20 CVE-2024-218769.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (form CVE-2024-218776.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (CVE-2024-218789.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as E CVE-2024-218798.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticat CVE-2024-21886.1Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability c CVE-2024-218807.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated CVE-2024-218818.6Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.T