by Kastro
Paper/Archive/CVE-2024-12372

CVE-2024-12372

Rockwell Automation PM1k 1408-BC3A-485 — Rockwell Automation PowerMonitor™ 1000 Denial of Service

EPSS 0.9%CVSS 9.3
critical.is priorityof 100
40
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 58.4.584 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.

Affected

ProductAffectedFixed inSource
PM1k 1408-BC3A-485<4.020–CNA
PM1k 1408-BC3A-ENT<4.020–CNA
PM1k 1408-TS3A-485<4.020–CNA
PM1k 1408-TS3A-ENT<4.020–CNA
PM1k 1408-EM3A-485<4.020–CNA
PM1k 1408-EM3A-ENT<4.020–CNA
PM1k 1408-TR1A-485<4.020–CNA
PM1k 1408-TR2A-485<v4.020–CNA
PM1k 1408-EM1A-485<4.020–CNA
PM1k 1408-EM2A-485<4.020–CNA
PM1k 1408-TR1A-ENT<4.020–CNA
PM1k 1408-TR2A-ENT<4.020–CNA

Scores by source

Rockwell (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refrockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html