CVE-2024-7987: Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities

Q: What is the severity of CVE-2024-7987?

CVE-2024-7987 has a high severity rating due to its potential for remote code execution with system privileges.

Q: How do I fix CVE-2024-7987?

To remediate CVE-2024-7987, update the Rockwell Automation ThinManager ThinServer to the latest version provided by the vendor.

Q: What software is affected by CVE-2024-7987?

CVE-2024-7987 specifically affects Rockwell Automation ThinManager ThinServer.

Q: Can CVE-2024-7987 be exploited remotely?

Yes, CVE-2024-7987 can be exploited remotely by a threat actor to execute arbitrary code.

Q: What are the potential impacts of CVE-2024-7987?

The potential impacts of CVE-2024-7987 include unauthorized access and execution of malicious code within the affected system.

Published Aug 26, 2024

Updated

A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. To exploit this vulnerability and a threat actor must abuse the ThinServer™ service by creating a junction and use it to upload arbitrary files.

Affected Software

8 affected components

Rockwell Automation ThinManager ThinServer

rockwellautomation Thinmanager Thinserver>=11.1.0<11.1.8

rockwellautomation Thinmanager Thinserver>=11.2.0<11.2.9

rockwellautomation Thinmanager Thinserver>=12.0.0<12.0.7

rockwellautomation Thinmanager Thinserver>=12.1.0<12.1.8

rockwellautomation Thinmanager Thinserver>=13.0.0<13.0.5

rockwellautomation Thinmanager Thinserver>=13.1.0<13.1.3

rockwellautomation Thinmanager Thinserver>=13.2.0<13.2.2

Remediation

Information

ffected Product First Known in software version Corrected in software version ThinManager® ThinServer™ 11.1.0-11.1.7 11.2.0-11.2.8 12.0.0-12.0.6 12.1.0-12.1.7 13.0.0-13.0.4 13.1.0-13.1.2 13.2.0-13.2.1 11.1.8 11.2.9 12.0.7 12.1.8 13.0.5 13.1.3 13.2.2 Mitigations and Workarounds Customers using the affected software are encouraged to implement our suggested security best practices to minimize the risk of vulnerability. · Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Event History

Aug 26, 2024

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-7987?

CVE-2024-7987 has a high severity rating due to its potential for remote code execution with system privileges.

How do I fix CVE-2024-7987?

To remediate CVE-2024-7987, update the Rockwell Automation ThinManager ThinServer to the latest version provided by the vendor.

What software is affected by CVE-2024-7987?