ICS: Multiple Rockwell Automation PowerMonitor Vulnerabilities

Severity

High

Analysis Summary

CVE-2024-12371 CVSS:9.8

Rockwell Automation PowerMonitor 1000 Remote could allow a remote attacker to bypass security restrictions, caused by unprotected alternate channel. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass access restrictions to perform editing operations, creating admin users and perform factory reset.

CVE-2024-12372 CVSS:9.8

Rockwell Automation PowerMonitor 1000 is vulnerable to a heap-based buffer overflow. By sending a specially crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the system to crash.

Impact

Security Bypass
Buffer Overflow

Indicators of Compromise

CVE

CVE-2024-12371
CVE-2024-12372

Affected Vendors

Rockwell Automation

Affected Products

Rockwell Automation PowerMonitor 1000 Remote
Rockwell Automation PowerMonitor 1000 Remote PM1k 1408-BC3A-485
Rockwell Automation PowerMonitor 1000 Remote PM1k 1408-BC3A-ENT
Rockwell Automation PowerMonitor 1000 Remote PM1k 1408-TS3A-485
Rockwell Automation PowerMonitor 1000 PM1k 1408-BC3A-485
Rockwell Automation PowerMonitor 1000 PM1k 1408-BC3A-ENT
Rockwell Automation PowerMonitor 1000 PM1k 1408-TS3A-485

Remediation

Refer to Rockwell Automation Advisory for patch, upgrade or suggested workaround information.

Rockwell Automation Advisory

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo