Vulnerability · Published Aug 26, 2024 · Assigned by Rockwell
CVE-2024-7988ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities
Critical 9.8
In plain English
A critical-severity improper input validation in ThinManager® ThinServer™ from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.8%top 8.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. This vulnerability exists due to the lack of proper data input validation, which allows files to be overwritten.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | ThinManager® ThinServer™ | 11.1.0-11.1.7 11.2.0-11.2.8 12.0.0-12.0.6 12.1.0-12.1.7 13.0.0-13.0.4 13.1.0-13.1.2 13.2.0-13.2.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H