No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: an anonymous researcher (Trend Micro's Zero Day Initiative)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-3617 | CWE-276 Incorrect Default Permissions | 7.8 High |
A privilege escalation vulnerability exists in Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges. Vendor fix: Rockwell Automation encourages users to update ThinManager to v14.0.2 or later to mitigate CVE-2025-3617. Mitigation: For information on how to mitigate security risks on industrial automation control systems, Rockwell Automation encourages users to implement their suggested security best practices to minimize the risk of the vulnerability. ↗ Mitigation: For more information about these issues, please see the Rockwell Automation security advisory SD1727. ↗ Affected, fixed & timelineAffected:
Mitigation: Stakeholder-Specific Vulnerability Categorization can be used to generate more environment-specific prioritization. |
| CVE-2025-3618 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.5 High |
A denial-of-service vulnerability exists in Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while processing Type 18 messages. If exploited, a threat actor could cause a denial of service on the target software. Vendor fix: Rockwell Automation fixed CVE-2025-3618 in the following versions of ThinManager: Vendor fix: ThinManager v11.2.11 Vendor fix: ThinManager v12.0.9 Affected, fixed & timelineAffected:
Vendor fix: ThinManager v13.1.5 Vendor fix: ThinManager v13.2.4 Vendor fix: ThinManager v14.0.2 Mitigation: For information on how to mitigate security risks on industrial automation control systems, Rockwell Automation encourages users to implement their suggested security best practices to minimize the risk of the vulnerability. Mitigation: For more information about these issues, please see the Rockwell Automation security advisory SD1727. Mitigation: Stakeholder-Specific Vulnerability Categorization can be used to generate more environment-specific prioritization. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-3617 | 8.5 High | Rockwell Automation ThinManager® A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary f… |
| CVE-2025-3618 | 8.5 High | Rockwell Automation ThinManager A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory alloca… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.