CVE-2024-12372 (GCVE-0-2024-12372)
Vulnerability from cvelistv5 – Published: 2024-12-18 15:28 – Updated: 2024-12-18 19:58
VLAI?
Summary
A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.
Severity ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rockwell Automation | PM1k 1408-BC3A-485 |
Affected:
<4.020
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-18T19:57:17.324443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T19:58:03.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-BC3A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-BC3A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TS3A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TS3A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM3A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM3A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TR1A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TR2A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003cv4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM1A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM2A-485",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TR1A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-TR2A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM1A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PM1k 1408-EM2A-ENT",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "\u003c4.020"
}
]
}
],
"datePublic": "2024-12-17T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T15:34:48.191Z",
"orgId": "b73dd486-f505-4403-b634-40b078b177f0",
"shortName": "Rockwell"
},
"references": [
{
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eAffected Products\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eAffected firmware revision\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eCorrected in firmware revision\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-BC3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-BC3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TS3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TS3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR1A-485\u003cb\u003e\u003c/b\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR2A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM1A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM2A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR1A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR2A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM1A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM2A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\n\n\u003cbr\u003e\n\n\u003cp\u003e\u003cb\u003eMitigations and Workarounds\u003c/b\u003e\u003c/p\u003e\u003cp\u003eUsers using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. \u0026nbsp; \u003c/p\u003e\u003cp\u003e\u00b7 \u0026nbsp; \u0026nbsp; \u0026nbsp; \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight\"\u003eSecurity Best Practices\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Affected Products\n\nAffected firmware revision\n\nCorrected in firmware revision\n\nPM1k 1408-BC3A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-BC3A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TS3A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TS3A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM3A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM3A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TR1A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TR2A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM1A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM2A-485\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TR1A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-TR2A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM1A-ENT\n\n\u003c4.020\n\n4.020\n\nPM1k 1408-EM2A-ENT\n\n\u003c4.020\n\n4.020\n\n\n\n\n\n\nMitigations and Workarounds\n\nUsers using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. \u00a0 \n\n\u00b7 \u00a0 \u00a0 \u00a0 Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight"
}
],
"source": {
"advisory": "SD1714",
"discovery": "EXTERNAL"
},
"title": "Rockwell Automation PowerMonitor\u2122 1000 Denial of Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
"assignerShortName": "Rockwell",
"cveId": "CVE-2024-12372",
"datePublished": "2024-12-18T15:28:25.266Z",
"dateReserved": "2024-12-09T17:50:51.305Z",
"dateUpdated": "2024-12-18T19:58:03.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\"}, {\"lang\": \"es\", \"value\": \"Existe una vulnerabilidad de denegaci\\u00f3n de servicio y posible ejecuci\\u00f3n remota de c\\u00f3digo en Rockwell Automation Power Monitor 1000. La vulnerabilidad provoca la corrupci\\u00f3n de la memoria del mont\\u00f3n, lo que puede comprometer la integridad del sistema y permitir potencialmente la ejecuci\\u00f3n remota de c\\u00f3digo o un ataque de denegaci\\u00f3n de servicio.\"}]",
"id": "CVE-2024-12372",
"lastModified": "2024-12-18T20:15:22.167",
"metrics": "{\"cvssMetricV40\": [{\"source\": \"PSIRT@rockwellautomation.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnerableSystemConfidentiality\": \"HIGH\", \"vulnerableSystemIntegrity\": \"HIGH\", \"vulnerableSystemAvailability\": \"HIGH\", \"subsequentSystemConfidentiality\": \"NONE\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NOT_DEFINED\", \"automatable\": \"NOT_DEFINED\", \"recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\"}}]}",
"published": "2024-12-18T16:15:11.050",
"references": "[{\"url\": \"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html\", \"source\": \"PSIRT@rockwellautomation.com\"}]",
"sourceIdentifier": "PSIRT@rockwellautomation.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-12372\",\"sourceIdentifier\":\"PSIRT@rockwellautomation.com\",\"published\":\"2024-12-18T16:15:11.050\",\"lastModified\":\"2024-12-18T20:15:22.167\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de denegaci\u00f3n de servicio y posible ejecuci\u00f3n remota de c\u00f3digo en Rockwell Automation Power Monitor 1000. La vulnerabilidad provoca la corrupci\u00f3n de la memoria del mont\u00f3n, lo que puede comprometer la integridad del sistema y permitir potencialmente la ejecuci\u00f3n remota de c\u00f3digo o un ataque de denegaci\u00f3n de servicio.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"PSIRT@rockwellautomation.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html\",\"source\":\"PSIRT@rockwellautomation.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-12372\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-18T19:57:17.324443Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-18T19:57:58.869Z\"}}], \"cna\": {\"title\": \"Rockwell Automation PowerMonitor\\u2122 1000 Denial of Service\", \"source\": {\"advisory\": \"SD1714\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-BC3A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-BC3A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TS3A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TS3A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM3A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM3A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TR1A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TR2A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003cv4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM1A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM2A-485\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TR1A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-TR2A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM1A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rockwell Automation\", \"product\": \"PM1k 1408-EM2A-ENT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c4.020\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Affected Products\\n\\nAffected firmware revision\\n\\nCorrected in firmware revision\\n\\nPM1k 1408-BC3A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-BC3A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TS3A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TS3A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM3A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM3A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TR1A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TR2A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM1A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM2A-485\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TR1A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-TR2A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM1A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\nPM1k 1408-EM2A-ENT\\n\\n\u003c4.020\\n\\n4.020\\n\\n\\n\\n\\n\\n\\nMitigations and Workarounds\\n\\nUsers using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. \\u00a0 \\n\\n\\u00b7 \\u00a0 \\u00a0 \\u00a0 Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eAffected Products\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eAffected firmware revision\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eCorrected in firmware revision\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-BC3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-BC3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TS3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TS3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM3A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM3A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR1A-485\u003cb\u003e\u003c/b\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR2A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM1A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM2A-485\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR1A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-TR2A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM1A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003ePM1k 1408-EM2A-ENT\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u0026lt;4.020\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e4.020\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\\n\\n\u003cbr\u003e\\n\\n\u003cp\u003e\u003cb\u003eMitigations and Workarounds\u003c/b\u003e\u003c/p\u003e\u003cp\u003eUsers using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. \u0026nbsp; \u003c/p\u003e\u003cp\u003e\\u00b7 \u0026nbsp; \u0026nbsp; \u0026nbsp; \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight\\\"\u003eSecurity Best Practices\u003c/a\u003e\u003c/p\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-12-17T14:00:00.000Z\", \"references\": [{\"url\": \"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\u003c/span\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"b73dd486-f505-4403-b634-40b078b177f0\", \"shortName\": \"Rockwell\", \"dateUpdated\": \"2024-12-18T15:34:48.191Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-12372\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-18T19:58:03.337Z\", \"dateReserved\": \"2024-12-09T17:50:51.305Z\", \"assignerOrgId\": \"b73dd486-f505-4403-b634-40b078b177f0\", \"datePublished\": \"2024-12-18T15:28:25.266Z\", \"assignerShortName\": \"Rockwell\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…