PT-2022-4894 · Rockwell Automation · Thinkserver+1

Published 2022-06-17 · Updated 2022-09-28 · CVE-2022-38742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation ThinManager ThinServer versions 11.0.0 through 13.0.0

Description The issue is related to a heap-based buffer overflow in the ThinServer component of Rockwell Automation ThinManager. This can be exploited by sending a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.

Recommendations For versions 11.0.0 through 13.0.0, consider disabling the ThinServer process until a patch is available to prevent exploitation. Restrict access to TFTP and HTTPS requests to minimize the risk of remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2022-06055

CVE-2022-38742

ZDI-22-1302

Affected Products

Thinmanager

Thinkserver

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-38742 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1302 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136847 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06055 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38742 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022093002 · Note
• https://vuldb.com/ru/?id.209464 · Note
• https://t.me/cvenotify/36840 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-270-03 · Note
• https://t.me/cibsecurity/50357 · Telegram Post