CVE-2024-12371

Rockwell Automation PowerMonitor™ 1000 Remote Code Execution

Description

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

Remediation

Solution:

Affected Products Affected firmware revision Corrected in firmware revision PM1k 1408-BC3A-485 <4.020 4.020 PM1k 1408-BC3A-ENT <4.020 4.020 PM1k 1408-TS3A-485 <4.020 4.020 PM1k 1408-TS3A-ENT <4.020 4.020 PM1k 1408-EM3A-485 <4.020 4.020 PM1k 1408-EM3A-ENT <4.020 4.020 PM1k 1408-TR1A-485 <4.020 4.020 PM1k 1408-TR2A-485 <4.020 4.020 PM1k 1408-EM1A-485 <4.020 4.020 PM1k 1408-EM2A-485 <4.020 4.020 PM1k 1408-TR1A-ENT <4.020 4.020 PM1k 1408-TR2A-ENT <4.020 4.020 PM1k 1408-EM1A-ENT <4.020 4.020 PM1k 1408-EM2A-ENT <4.020 4.020 Mitigations and Workarounds Users using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. · Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

References

Link	Tags
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html

Frequently Asked Questions

What is the severity of CVE-2024-12371?: CVE-2024-12371 has been scored as a critical severity vulnerability.
How to fix CVE-2024-12371?: To fix CVE-2024-12371: Affected Products Affected firmware revision Corrected in firmware revision PM1k 1408-BC3A-485 <4.020 4.020 PM1k 1408-BC3A-ENT <4.020 4.020 PM1k 1408-TS3A-485 <4.020 4.020 PM1k 1408-TS3A-ENT <4.020 4.020 PM1k 1408-EM3A-485 <4.020 4.020 PM1k 1408-EM3A-ENT <4.020 4.020 PM1k 1408-TR1A-485 <4.020 4.020 PM1k 1408-TR2A-485 <4.020 4.020 PM1k 1408-EM1A-485 <4.020 4.020 PM1k 1408-EM2A-485 <4.020 4.020 PM1k 1408-TR1A-ENT <4.020 4.020 PM1k 1408-TR2A-ENT <4.020 4.020 PM1k 1408-EM1A-ENT <4.020 4.020 PM1k 1408-EM2A-ENT <4.020 4.020 Mitigations and Workarounds Users using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. · Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Is CVE-2024-12371 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-12371 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-12371?: CVE-2024-12371 affects Rockwell Automation PM1k 1408-BC3A-485, Rockwell Automation PM1k 1408-BC3A-ENT, Rockwell Automation PM1k 1408-TS3A-485, Rockwell Automation PM1k 1408-TS3A-ENT, Rockwell Automation PM1k 1408-EM3A-485, Rockwell Automation PM1k 1408-EM3A-ENT, Rockwell Automation PM1k 1408-TR1A-485, Rockwell Automation PM1k 1408-TR2A-485, Rockwell Automation PM1k 1408-EM1A-485, Rockwell Automation PM1k 1408-EM2A-485, Rockwell Automation PM1k 1408-TR1A-ENT, Rockwell Automation PM1k 1408-TR2A-ENT, Rockwell Automation PM1k 1408-EM1A-ENT, Rockwell Automation PM1k 1408-EM2A-ENT.

Description

Remediation

Category

CWE-306 – Missing Authentication for Critical Function

References

Frequently Asked Questions