Skip to content
Sign in
9.3 Critical

CVE-2024-12371 A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000

Description

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

Affected products and versions

Product Affected versions Fixed in
PM1k 1408-BC3A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-BC3A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-TS3A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-TS3A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-EM3A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-EM3A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-TR1A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-TR2A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-EM1A-485 4.020 earliest → < 4.020 4.020
Show the 5 other branches
Product Affected versions Fixed in
PM1k 1408-EM2A-485 4.020 earliest → < 4.020 4.020
PM1k 1408-TR1A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-TR2A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-EM1A-ENT 4.020 earliest → < 4.020 4.020
PM1k 1408-EM2A-ENT 4.020 earliest → < 4.020 4.020

Other CVEs of PM1k 1408-BC3A-485

The 3 CVEs of PM1k 1408-BC3A-485 →
CVE-2024-12373 A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000 9.3 Critical CVE-2024-12372 A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor… 9.3 Critical
Track this CVE