PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-10386 Rockwell Automation CVE debrief

A critical authentication vulnerability in Rockwell Automation FactoryTalk ThinManager allows unauthenticated network attackers to send crafted messages that may result in database manipulation. The flaw affects multiple ThinManager versions from 11.2.0 through 14.0.0. Rockwell Automation has released patches for all affected versions.

Vendor
Rockwell Automation
Product
ThinManager
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-31
Original CVE updated
2024-10-31
Advisory published
2024-10-31
Advisory updated
2024-10-31

Who should care

Organizations running Rockwell Automation FactoryTalk ThinManager versions 11.2.0 through 14.0.0, particularly in industrial control system (ICS) environments where ThinManager manages thin client deployments for manufacturing, process control, and critical infrastructure operations.

Technical summary

The vulnerability exists in the authentication mechanism of FactoryTalk ThinManager. A threat actor with network access can send crafted messages to the device without authentication, potentially resulting in database manipulation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network exploitable, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

  • Apply vendor patches immediately from the FactoryTalk ThinManager download site for affected versions: 11.2.x before 11.2.9, 12.0.x before 12.0.7, 12.1.x before 12.1.8, 13.0.x before 13.0.5, 13.1.x before 13.1.3, 13.2.x

Evidence notes

CISA published advisory ICSA-24-305-01 on 2024-10-31 with CVSS 3.1 score 9.8 (Critical). The vulnerability is an authentication bypass allowing network-based attackers to manipulate the ThinManager database without credentials.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-10386 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-10386

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-10386 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-10386

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-305-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-305-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.