Heap-based buffer overflow in Rockwell Automation products - CVE-2024-12372

Vulnerability identifier: #VU102446

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-12372

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Rockwell Automation

Affected software:
PowerMonitor 1000 PM1k 1408-BC3A-485
PowerMonitor 1000 PM1k 1408-BC3A-ENT
PowerMonitor 1000 PM1k 1408-TS3A-485
PowerMonitor 1000 PM1k 1408-TS3A-ENT
PowerMonitor 1000 PM1k 1408-EM3A-485
PowerMonitor 1000 PM1k 1408-EM3A-ENT
PowerMonitor 1000 PM1k 1408-TR1A-485
PowerMonitor 1000 PM1k 1408-TR2A-485
PowerMonitor 1000 PM1k 1408-EM1A-485
PowerMonitor 1000 PM1k 1408-EM2A-485
PowerMonitor 1000 PM1k 1408-TR1A-ENT
PowerMonitor 1000 PM1k 1408-TR2A-ENT
PowerMonitor 1000 PM1k 1408-EM1A-ENT
PowerMonitor 1000 PM1k 1408-EM2A-ENT

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03