CVE-2024-12371: Rockwell Automation PM1k 1408-BC3A-485, заобикаляне на

Описание

Оригинално описание

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.

Засегнати продукти

• Rockwell Automation PM1k 1408-BC3A-485: <4.020
• Rockwell Automation PM1k 1408-BC3A-ENT: <4.020
• Rockwell Automation PM1k 1408-TS3A-485: <4.020
• Rockwell Automation PM1k 1408-TS3A-ENT: <4.020
• Rockwell Automation PM1k 1408-EM3A-485: <4.020
• Rockwell Automation PM1k 1408-EM3A-ENT: <4.020
• Rockwell Automation PM1k 1408-TR1A-485: <4.020
• Rockwell Automation PM1k 1408-TR2A-485: <v4.020
• Rockwell Automation PM1k 1408-EM1A-485: <4.020
• Rockwell Automation PM1k 1408-EM2A-485: <4.020
• Rockwell Automation PM1k 1408-TR1A-ENT: <4.020
• Rockwell Automation PM1k 1408-TR2A-ENT: <4.020
• Rockwell Automation PM1k 1408-EM1A-ENT: <4.020
• Rockwell Automation PM1k 1408-EM2A-ENT: <4.020

Вид слабост

• CWE-306 Липсваща автентикация за критична функционалност

История

Други уязвимости в Rockwell Automation PM1k 1408-BC3A-485

• 9.3CVE-2024-12373
• 9.3CVE-2024-12372

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-12371
• https://nvd.nist.gov/vuln/detail/CVE-2024-12371
• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html