CVE-2024-12373: Power Monitor 1000 DoS Vulnerability

CVE-2024-12373 Overview

CVE-2024-12373 is a buffer overflow vulnerability [CWE-120] in the Rockwell Automation Power Monitor 1000. The flaw allows an unauthenticated remote attacker to trigger a buffer overflow condition, resulting in denial-of-service (DoS) against the affected industrial device. Power Monitor 1000 units are deployed in industrial and operational technology (OT) environments where availability directly impacts production continuity.

Critical Impact

An unauthenticated attacker with network access can crash the Power Monitor 1000, disrupting power monitoring functions in industrial environments.

Affected Products

• Rockwell Automation Power Monitor 1000

Discovery Timeline

• 2024-12-18 - CVE-2024-12373 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12373

Vulnerability Analysis

The vulnerability resides in the Rockwell Automation Power Monitor 1000 firmware. The device fails to properly validate input length before copying data into a fixed-size memory buffer. This classic buffer overflow condition [CWE-120] corrupts adjacent memory regions during processing of attacker-controlled input.

The overflow leads to a denial-of-service condition that takes the device offline. Power Monitor 1000 devices provide real-time electrical metering and monitoring within industrial control system (ICS) environments. Loss of monitoring data can cascade into operational blind spots for plant operators.

Network accessibility makes this issue practical to exploit remotely. The attacker requires no authentication, no user interaction, and no special privileges to send the malformed input.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer. The firmware copies input data into a stack or heap buffer without verifying that the input size fits within the allocated space. Consult the Rockwell Automation Security Advisory SD1714 for technical specifics on the affected component.

Attack Vector

The attack vector is network-based. An attacker sends a crafted request to a network-exposed service on the Power Monitor 1000. The malformed payload exceeds expected length bounds, triggering the overflow and crashing the device. No verified public proof-of-concept code is currently available.

Detection Methods for CVE-2024-12373

Indicators of Compromise

• Unexpected reboots, communication loss, or unresponsive states on Power Monitor 1000 devices
• Anomalous network traffic to Power Monitor 1000 management interfaces from unexpected sources
• Repeated malformed packets or oversized requests targeting Rockwell Automation device ports

Detection Strategies

• Monitor ICS network segments for unauthorized inbound connections to Power Monitor 1000 devices
• Deploy network intrusion detection signatures tuned for malformed Rockwell Automation protocol traffic
• Correlate device uptime telemetry with network logs to identify crash-restart patterns coinciding with suspicious traffic

Monitoring Recommendations

• Baseline normal Power Monitor 1000 communication patterns and alert on deviations
• Forward ICS device syslog and SNMP traps to a centralized SIEM for correlation
• Track repeated TCP resets or session terminations originating from Power Monitor 1000 IP addresses

How to Mitigate CVE-2024-12373

Immediate Actions Required

• Apply the firmware update referenced in Rockwell Automation Security Advisory SD1714
• Inventory all Power Monitor 1000 deployments and confirm firmware versions
• Restrict network access to Power Monitor 1000 management interfaces to authorized engineering workstations only

Patch Information

Rockwell Automation has published remediation guidance in security advisory SD1714. Review the vendor advisory for affected firmware versions and the corresponding fixed releases. Schedule patch deployment through standard ICS change-management processes to avoid operational disruption.

Workarounds

• Place Power Monitor 1000 devices behind ICS-aware firewalls and segment them from enterprise networks per ISA/IEC 62443 zone-and-conduit guidance
• Block external access to Power Monitor 1000 ports at the network perimeter
• Disable unused network services on the device where configuration permits
• Use jump hosts and VPN access for any required remote administration

# Configuration example: restrict Power Monitor 1000 access at the firewall
# Replace <PM1000_IP> and <ENG_WORKSTATION_SUBNET> with environment values
iptables -A FORWARD -s <ENG_WORKSTATION_SUBNET> -d <PM1000_IP> -j ACCEPT
iptables -A FORWARD -d <PM1000_IP> -j DROP