ICSA-24-305-01: Rockwell Automation FactoryTalk ThinManager

Summary

Successful exploitation of these vulnerabilities could allow an attacker to send crafted messages to the device resulting in database manipulation or a denial-of-service condition. CVE-2024-10386: An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation. CVE-2024-10387: A denial-of-service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, resulting in a denial-of-service condition.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-24-305-01
Status: Final · version 1
Initial release: 2024-10-31
Last revised: 2024-10-31
Vendor: Rockwell Automation
Critical infrastructure sectors: Critical Manufacturing
Deployed: Worldwide
Vendor headquarters: United States

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Tenable Network Security

Affected products (1)

ThinManager — >=11.2.0|<11.2.9, >=12.0.0|<12.0.7, >=12.1.0|<12.1.8, >=13.0.0|<13.0.5, >=13.1.0|<13.1.3, >=13.2.0|<13.2.2, 14.0.0

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2024-10386	CWE-306 Missing Authentication for Critical Function	9.8 Critical	An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation. Vendor fix: Rockwell Automation has provided a fix for the affected versions on the FactoryTalk ThinManager download site. ↗ Mitigation: Rockwell Automation encourages users of the affected software to apply these risk mitigations if possible. Vendor fix: Implement network hardening for ThinManager Device(s) by limiting communications to TCP 2031 to only the devices that need connection to the ThinManager. Affected, fixed & timeline Affected: ThinManager >=11.2.0\|<11.2.9 ThinManager >=12.0.0\|<12.0.7 ThinManager >=12.1.0\|<12.1.8 ThinManager >=13.0.0\|<13.0.5 ThinManager >=13.1.0\|<13.1.3 ThinManager >=13.2.0\|<13.2.2 ThinManager 14.0.0 Mitigation: For information on how to mitigate security risks on industrial automation control systems, users are encouraged to implement Rockwell Automation's suggested security best practices to minimize the risk of the vulnerability. Mitigation: For more information, see Rockwell Automation's security bulletin.
CVE-2024-10387	CWE-125 Out-of-bounds Read	7.5 High	A denial-of-service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, resulting in a denial-of-service condition. Vendor fix: Rockwell Automation has provided a fix for the affected versions on the FactoryTalk ThinManager download site. ↗ Mitigation: Rockwell Automation encourages users of the affected software to apply these risk mitigations if possible. Vendor fix: Implement network hardening for ThinManager Device(s) by limiting communications to TCP 2031 to only the devices that need connection to the ThinManager. Affected, fixed & timeline Affected: ThinManager >=11.2.0\|<11.2.9 ThinManager >=12.0.0\|<12.0.7 ThinManager >=12.1.0\|<12.1.8 ThinManager >=13.0.0\|<13.0.5 ThinManager >=13.1.0\|<13.1.3 ThinManager >=13.2.0\|<13.2.2 ThinManager 14.0.0 Mitigation: For information on how to mitigate security risks on industrial automation control systems, users are encouraged to implement Rockwell Automation's suggested security best practices to minimize the risk of the vulnerability. Mitigation: For more information, see Rockwell Automation's security bulletin.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-10386	9.3 Critical	Rockwell Automation FactoryTalk ThinManager CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network ac…
CVE-2024-10387	8.7 High	Rockwell Automation FactoryTalk ThinManager CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Rockwell 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.

CyberzSOC