CVE-2024-12371 | THREATINT

Description

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

Reserved 2024-12-09 | Published 2024-12-18 | Updated 2024-12-18 | Assigner Rockwell

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Product status

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

Default status

unaffected

<4.020

affected

References

www.rockwellautomation.com/...dvisories/advisory.SD1714.html

cve.org (CVE-2024-12371)

nvd.nist.gov (CVE-2024-12371)

Download JSON