Popular Industrial Power Monitors Had Remote Hacking Flaws

A ubiquitous industrial power monitoring device contains three critical vulnerabilities in its firmware that could allow attackers to disrupt operations by remotely crashing them or executing unwanted code.

See Also: Enhance Industrial Security and Minimize Production Downtime

The device, the Rockwell Automation PowerMonitor 1000 Remote, received firmware updates from its manufacturer in December after researchers from security firm Claroty identified flaws. The U.S. Cybersecurity and Infrastructure Security Agency warned the flaws are remotely exploitable and have low attack complexity.

The PowerMonitor 1000 is ubiquitous across factories and critical systems, used in operations ranging from grid capacity planning to monitoring power supply agreements. “Even seemingly innocuous devices like power monitors can become targets for malicious actors,” wrote Claroty researchers in a Wednesday blog post.

All three vulnerabilities have received a CVSS score of 9.8 from CISA.

The first flaw, tracked CVE-2024-12371, is an authentication bypass issue. Due to a logic flaw in how the device handles its initial setup page, an attacker can trigger a “first-run” setup process to create a new administrative account even on already-configured systems. This enables complete unauthorized access without any valid credentials.

Another vulnerability, CVE-2024-12373, is a buffer overflow that stems from insufficient checks on web-based configuration requests. By sending a request with an excessive number of parameters, an attacker can overwrite memory adjacent to authentication flags, granting themselves privileged access or potentially executing malicious code.

The third flaw, CVE-2024-12372, involves a heap buffer overflow in the digest authentication process. A malicious actor can exploit this by sending a long uniform resource identifier during login. Because the device uses unsafe memory functions like sprintf without bounds checks, it allows overwriting of critical memory structures.

Claroty reverse-engineered the firmware available on Rockwell Automation’s website to uncover the vulnerabilities. The firmware runs on a real-time operating system based on Digi’s NET+OS and uses the Treck TCP/IP stack, a combination not uncommon in embedded industrial systems. This architecture complicates vulnerability detection.

Rockwell Automation published updated firmware tracked as revision 4.020 late last year.

The company urges users to update affected devices immediately. Security advisories have also been published by both Rockwell and CISA, providing mitigation steps and further technical details.