Description
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rockwell Automation | ThinManager | 13.0 - 14.0 | — |
Advisories 1
- ICSA-25-252-01 Rockwell Automation ThinManager CISA ICS & IT advisories · Sep 9, 2025