{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2024-12372", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2024-12-09T17:50:51.305Z", "datePublished": "2024-12-18T15:28:25.266Z", "dateUpdated": "2024-12-18T19:58:03.337Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "PM1k 1408-BC3A-485", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-BC3A-ENT", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-TS3A-485", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-TS3A-ENT", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-EM3A-485", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-EM3A-ENT", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-TR1A-485", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "<4.020" } ] }, { "defaultStatus": "unaffected", "product": "PM1k 1408-TR2A-485", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.\n\n
" } ], "value": "A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack." } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "providerMetadata": { "orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2024-12-18T15:34:48.191Z" }, "references": [ { "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Affected Products

Affected firmware revision

Corrected in firmware revision

PM1k 1408-BC3A-485

<4.020

4.020

PM1k 1408-BC3A-ENT

<4.020

4.020

PM1k 1408-TS3A-485

<4.020

4.020

PM1k 1408-TS3A-ENT

<4.020

4.020

PM1k 1408-EM3A-485

<4.020

4.020

PM1k 1408-EM3A-ENT

<4.020

4.020

PM1k 1408-TR1A-485

<4.020

4.020

PM1k 1408-TR2A-485

<4.020

4.020

PM1k 1408-EM1A-485

<4.020

4.020

PM1k 1408-EM2A-485

<4.020

4.020

PM1k 1408-TR1A-ENT

<4.020

4.020

PM1k 1408-TR2A-ENT

<4.020

4.020

PM1k 1408-EM1A-ENT

<4.020

4.020

PM1k 1408-EM2A-ENT

<4.020

4.020

\n\n
\n\n

Mitigations and Workarounds

Users using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible.  

·       Security Best Practices

\n\n
" } ], "value": "Affected Products\n\nAffected firmware revision\n\nCorrected in firmware revision\n\nPM1k 1408-BC3A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-BC3A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-TS3A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-TS3A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-EM3A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-EM3A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-TR1A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-TR2A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-EM1A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-EM2A-485\n\n<4.020\n\n4.020\n\nPM1k 1408-TR1A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-TR2A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-EM1A-ENT\n\n<4.020\n\n4.020\n\nPM1k 1408-EM2A-ENT\n\n<4.020\n\n4.020\n\n\n\n\n\n\nMitigations and Workarounds\n\nUsers using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible.   \n\n·       Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight" } ], "source": { "advisory": "SD1714", "discovery": "EXTERNAL" }, "title": "Rockwell Automation PowerMonitor™ 1000 Denial of Service", "x_generator": { "engine": "Vulnogram 0.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')" } ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-12-18T19:57:17.324443Z", "id": "CVE-2024-12372", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-18T19:58:03.337Z" } } ] } }