Unprotected Alternate Channel in Rockwell Automation products - CVE-2024-12371

Vulnerability identifier: #VU102445

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-12371

CWE-ID: CWE-420

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Rockwell Automation

Affected software:
PowerMonitor 1000 PM1k 1408-BC3A-485
PowerMonitor 1000 PM1k 1408-BC3A-ENT
PowerMonitor 1000 PM1k 1408-TS3A-485
PowerMonitor 1000 PM1k 1408-TS3A-ENT
PowerMonitor 1000 PM1k 1408-EM3A-485
PowerMonitor 1000 PM1k 1408-EM3A-ENT
PowerMonitor 1000 PM1k 1408-TR1A-485
PowerMonitor 1000 PM1k 1408-TR2A-485
PowerMonitor 1000 PM1k 1408-EM1A-485
PowerMonitor 1000 PM1k 1408-EM2A-485
PowerMonitor 1000 PM1k 1408-TR1A-ENT
PowerMonitor 1000 PM1k 1408-TR2A-ENT
PowerMonitor 1000 PM1k 1408-EM1A-ENT
PowerMonitor 1000 PM1k 1408-EM2A-ENT

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the device takeover issue. A remote attacker can configure a new Policyholder user without any authentication via API.

Install updates from vendor's website.

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03