HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2025-3617

CVSS 8.5v4.0pub. 2025-04-15upd. 2025-07-14

A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges.

CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Rockwellautomation Thinmanager

    APP
    Rockwellautomation
    14.0.0 – 14.0.2 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2024-10386CRITICAL9.3PL ✓ten sam produkt

Rockwell Automation ThinManager — brak uwierzytelnienia umożliwia manipulację bazą danych

CVE-2024-5988CRITICAL9.3PL ✓ten sam produkt

RCE w Rockwell Automation ThinManager poprzez improper input validation

CVE-2024-5989CRITICAL9.3PL ✓ten sam produkt

RCE i SQL injection w Rockwell Automation ThinManager ThinServer

CVE-2023-27855CRITICAL9.8ten sam produkt

In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ...

CVE-2025-9065HIGH8.6ten sam produkt

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to th...