CVE-2024-11220

8.5 highEPSS 0.2%

High (8.5) in openautomationsoftware open automation software. EPSS 0.2% chance of exploitation in the next 30 days.

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWEs: CWE-732, CWE-279
Published: 2024-12-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openautomationsoftware:open_automation_software

References

https://openautomationsoftware.com/downloads/
https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03

Check your stack JSON