CVE-2024-5989: Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

Q: What is the severity of CVE-2024-5989?

CVE-2024-5989 is considered a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2024-5989?

To fix CVE-2024-5989, update Rockwell Automation ThinManager and ThinServer to the latest patched versions as provided by the vendor.

Q: What types of systems are affected by CVE-2024-5989?

CVE-2024-5989 affects specific versions of Rockwell Automation ThinManager and ThinServer software, specifically versions between 11.1.0 to 13.2.2.

Q: Who can exploit CVE-2024-5989?

CVE-2024-5989 can be exploited by unauthenticated threat actors who can send malicious input to the affected systems.

Q: What kind of attack does CVE-2024-5989 enable?

CVE-2024-5989 enables SQL injection attacks that could lead to remote code execution on the vulnerable systems.

Published Jun 25, 2024

Updated

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™.

Affected Software

14 affected components

rockwellautomation Thinmanager>=11.1.0<11.1.8

rockwellautomation Thinmanager>=11.2.0<11.2.9

rockwellautomation Thinmanager>=12.0.0<12.0.7

rockwellautomation Thinmanager>=12.1.0<12.1.8

rockwellautomation Thinmanager>=13.0.0<13.0.5

rockwellautomation Thinmanager>=13.1.0<13.1.3

rockwellautomation Thinmanager>=13.2.0<13.2.2

rockwellautomation Thinserver>=11.1.0<11.1.8

rockwellautomation Thinserver>=11.2.0<11.2.9

rockwellautomation Thinserver>=12.0.0<12.0.7

rockwellautomation Thinserver>=12.1.0<12.1.8

rockwellautomation Thinserver>=13.0.0<13.0.5

rockwellautomation Thinserver>=13.1.0<13.1.3

rockwellautomation Thinserver>=13.2.0<13.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 11.1.8
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 11.2.9
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 12.0.7
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 12.1.8
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 13.0.5
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 13.0.4
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 13.1.3
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 13.1.2
Upgrade
Upgrade Rockwell Automation ThinManager ThinServer to a version that resolves this vulnerability.
Fixed in 13.2.2
Compensating control
Limit remote access for TCP Port 2031 to known thin clients and ThinManager ThinServer servers.

Event History

Jun 25, 2024

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-5989?

CVE-2024-5989 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2024-5989?