Rockwell Automation Thinmanager vulnerabilities
5 vulnerabilities
Known vulnerabilities in Rockwell Automation Thinmanager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-9065rockwell automationthinmanager+1
EPSS score0.47%
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.CVE-2025-3618rockwell automationthinmanager+1EPSS score1.78%
A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while processing Type 18 messages. If exploited, a threat actor could cause a denial-of-service on the target software.CVE-2025-3617rockwell automationthinmanager+1EPSS score0.30%
A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges.CVE-2024-45826rockwell automationthinmanager+1EPSS score12.34%
CVE-2024-45826 IMPACT
Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.CVE-2023-2443rockwell automationthinmanager+1EPSS score0.67%
Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.