CVE-2018-19616: rockwellautomation powermonitor_1000_firmware Improper Authentication
Vulnerability summary
CVE-2018-19616 is a high (CVSS 8.1) Improper Authentication vulnerability in rockwellautomation powermonitor_1000_firmware. EPSS estimates a 30.29% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 26-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
30.29%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 30.29% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Rockwellautomation1 product
- powermonitor_1000_firmware1408-em3a-ent_b
1 vendor · 1 product
References
5 links- ics-cert.us-cert.gov/advisories/ICSA-19-050-04X Refsource MISCThird Party AdvisoryUS Government Resource