PT-2024-8117 · Rockwell Automation · Rockwell Automation Thinmanager Thinserver

Nicholas Zubrisky · Published 2024-04-24 · Updated 2024-08-26 · CVE-2024-7987

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ThinManager ThinServer (affected versions not specified)

Description: A remote code execution issue exists in the Rockwell Automation ThinManager ThinServer, allowing a threat actor to execute arbitrary code with System privileges. This is achieved by abusing the ThinServer service, creating a junction, and uploading arbitrary files. The vulnerability is related to incorrect permission assignment for a critical resource, which can be exploited by a remote attacker to run arbitrary code.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Incorrect Permission

Weakness Enumeration

CWE-434

CWE-732

Related Identifiers

BDU:2024-09649

CVE-2024-7987

ZDI-24-1157

Affected Products

Rockwell Automation Thinmanager Thinserver

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-7987 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1157 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7987 · Vendor Advisory
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1692.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09649 · Security Note
• https://t.me/cvedetector/4160 · Telegram Post
• https://twitter.com/CVEnew/status/1828082843748106628 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-24006 · Note
• https://twitter.com/CveFindCom/status/1828085520771002797 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1826721439455592546 · Twitter Post