PT-2024-7516 · Rockwell Automation · Rockwell Automation Thinmanager

Published 2024-10-25 · Updated 2024-11-14 · CVE-2024-10386

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation ThinManager (affected versions not specified)

Description An authentication issue exists in the affected product, allowing a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation. The vulnerability is related to the possibility of sending requests to the database without passing the authentication procedure. This could enable a remote attacker to make changes to the database by sending specially formed messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-08913

CVE-2024-10386

Affected Products

Rockwell Automation Thinmanager

References · 11

• https://bdu.fstec.ru/vul/2024-08913 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10386 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1708.html · Vendor Advisory
• https://twitter.com/transilienceai/status/1856386739222483050 · Twitter Post
• https://t.me/cvedetector/8968 · Telegram Post
• https://twitter.com/HazPr0/status/1854007345258299551 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1853611524662952213 · Twitter Post
• https://twitter.com/transilienceai/status/1856929538699042983 · Twitter Post
• https://twitter.com/transilienceai/status/1857115957786972550 · Twitter Post
• https://twitter.com/transilienceai/status/1856929607074676771 · Twitter Post