CVE-2018-19616

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

30.29%

Published

Dec 26, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

Exploit-DBRockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.

Weaknesses (CWE)

CWE-287

Affected Products (2)

rockwellautomation · powermonitor_1000_firmwarevulnerable

rockwellautomation · powermonitor_1000

References (10)

http://packetstormsecurity.com/files/150619/Rockwell-Automation-Allen-Bradley-PowerMonitor-1000-Authentication-Bypass.html

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/106333

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/108538

https://ics-cert.us-cert.gov/advisories/ICSA-19-050-04

Third Party AdvisoryUS Government Resource

https://www.exploit-db.com/exploits/45937/

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/150619/Rockwell-Automation-Allen-Bradley-PowerMonitor-1000-Authentication-Bypass.html

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/106333

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/108538

https://ics-cert.us-cert.gov/advisories/ICSA-19-050-04

Third Party AdvisoryUS Government Resource

https://www.exploit-db.com/exploits/45937/

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs