Critical severity · published Dec 18, 2024
CVE-2024-12371
Rockwell Automation PowerMonitor™ 1000 Remote Code Execution
9.3
CVSS
0.5%
EPSS
No
On KEV
Description
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
PM1k 1408-BC3A-485 · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-BC3A-ENT · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM1A-485 · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM1A-ENT · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM2A-485 · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM2A-ENT · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM3A-485 · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-EM3A-ENT · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-TR1A-485 · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-TR1A-ENT · Rockwell Automation
<4.020 · source: vendor
P1
PM1k 1408-TR2A-485 · Rockwell Automation
<v4.020 · source: vendor
P1
PM1k 1408-TR2A-ENT · Rockwell Automation
<4.020 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12371
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
More from PM1k 1408-BC3A-485
9.3
CVE-2024-12373
Rockwell Automation PowerMonitor™ 1000 Denial of Service
9.3
CVE-2024-12372
Rockwell Automation PowerMonitor™ 1000 Denial of Service