CVE-2024-12371

Rockwell Automation PowerMonitor™ 1000 Remote Code Execution

Critical · published December 18, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00546 · 45.0th percentile
Published
2024-12-18T15:23Z
EPSS history
Timeline
  • 18 DEC 15:23Z
    Rockwell Automation PowerMonitor™ 1000 Remote Code Execution
    cvelistv5