Log in Start free

Vulnerability · Published Jul 11, 2023 · Assigned by Rockwell

CVE-2023-2072Rockwell Automation PowerMonitor 1000 Cross-Site Scripting Vulnerability

High 8.8

In plain English

A high-severity out-of-bounds write in PowerMonitor 1000 from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Rockwell Automation PowerMonitor 1000 contains stored cross-site scripting vulnerabilities within the web page of the product.  The vulnerable pages do not require privileges to access and can be injected with code by an attacker which could be used to leverage an attack on an authenticated user resulting in remote code execution and potentially the complete loss of confidentiality, integrity, and availability of the product.

Affected products (as reported)

VendorProductVersions
Rockwell Automation PowerMonitor 1000 V4.011

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References