CVE-2024-22016

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Rapid Software LLC	Rapid SCADA	<= 5.8.4

References

https://rapidscada.org/contact/Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03Third Party Advisory, US Government Resource
https://rapidscada.org/contact/Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03Third Party Advisory, US Government Resource

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220177.3setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform CVE-2024-220182.9A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. CVE-2024-220197.5A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour CVE-2024-22025.4The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions CVE-2024-220206.5A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can e CVE-2024-220214.3Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Sco CVE-2024-220228.8Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash CVE-2024-220235.3An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unaut CVE-2024-220248.3An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and CVE-2024-220256.5A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet CVE-2024-220266.7A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut CVE-2024-220276.5Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a