Riskcovery

CVE-2024-12371

Rockwell Automation PowerMonitor™ 1000 Remote Code Execution

State
Published
Severity
9.3 Critical
Published
Dec 18, 2024
Updated
Dec 18, 2024
Reserved
Dec 9, 2024

Read the record on cve.org

Description

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NRockwell

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
PM1k 1408-BC3A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-BC3A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-TS3A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-TS3A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-EM3A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-EM3A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-TR1A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-TR2A-485Rockwell Automation
  • <v4.020Affected
PM1k 1408-EM1A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-EM2A-485Rockwell Automation
  • <4.020Affected
PM1k 1408-TR1A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-TR2A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-EM1A-ENTRockwell Automation
  • <4.020Affected
PM1k 1408-EM2A-ENTRockwell Automation
  • <4.020Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.