Vulnerability · Published Dec 18, 2024 · Assigned by Rockwell
CVE-2024-12372Rockwell Automation PowerMonitor™ 1000 Denial of Service
Critical 9.3
In plain English
A critical-severity code injection in PM1k 1408-BC3A-485 from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.9%top 41.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | PM1k 1408-BC3A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-BC3A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-TS3A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-TS3A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-EM3A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-EM3A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-TR1A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-TR2A-485 | <v4.020 |
| Rockwell Automation | PM1k 1408-EM1A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-EM2A-485 | <4.020 |
| Rockwell Automation | PM1k 1408-TR1A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-TR2A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-EM1A-ENT | <4.020 |
| Rockwell Automation | PM1k 1408-EM2A-ENT | <4.020 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N