ZDI-24-1156: Rockwell Automation ThinManager ThinServer Arbitrary File Read Information Disclosure Vulnerability
This vulnerability allows local attackers to read arbitrary files on affected installations of Rockwell Automation ThinManager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2024-7986.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1156?
The severity of ZDI-24-1156 is classified as high due to the potential impact of local attackers being able to read arbitrary files.
How do I fix ZDI-24-1156?
To fix ZDI-24-1156, update your Rockwell Automation ThinManager installation to the latest version that addresses this vulnerability.
Who is affected by ZDI-24-1156?
ZDI-24-1156 affects installations of Rockwell Automation ThinManager, particularly those running vulnerable configurations.
Can ZDI-24-1156 be exploited remotely?
No, ZDI-24-1156 requires local access for an attacker to exploit the vulnerability.
What type of attack does ZDI-24-1156 facilitate?
ZDI-24-1156 facilitates file reading attacks by enabling local attackers to access sensitive files on the affected system.