CVE-2024-12372

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
Rockwell AutomationPM1k 1408-BC3A-485<4.020
Rockwell AutomationPM1k 1408-BC3A-ENT<4.020
Rockwell AutomationPM1k 1408-TS3A-485<4.020
Rockwell AutomationPM1k 1408-TS3A-ENT<4.020
Rockwell AutomationPM1k 1408-EM3A-485<4.020
Rockwell AutomationPM1k 1408-EM3A-ENT<4.020
Rockwell AutomationPM1k 1408-TR1A-485<4.020
Rockwell AutomationPM1k 1408-TR2A-485<v4.020
Rockwell AutomationPM1k 1408-EM1A-485<4.020
Rockwell AutomationPM1k 1408-EM2A-485<4.020
Rockwell AutomationPM1k 1408-TR1A-ENT<4.020
Rockwell AutomationPM1k 1408-TR2A-ENT<4.020
Rockwell AutomationPM1k 1408-EM1A-ENT<4.020
Rockwell AutomationPM1k 1408-EM2A-ENT<4.020

References

Timeline

Published
Dec 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-123739.3A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, poteCVE-2024-123746.1A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can uploadCVE-2024-123756.5A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerabiliCVE-2024-123767.5A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version giCVE-2024-123789.1On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent overCVE-2024-123796.5A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to CVE-2024-12385.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versioCVE-2024-123807.5An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8CVE-2024-123818.8Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a craftedCVE-2024-123828.8Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a CVE-2024-123836.1The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This CVE-2024-123846.1The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up