PatchSiren cyber security CVE debrief

CVE-2024-7988 Rockwell Automation CVE debrief

A critical remote code execution vulnerability in Rockwell Automation ThinManager ThinServer allows unauthenticated threat actors to execute arbitrary code with System privileges. The vulnerability stems from insufficient input validation that enables arbitrary file overwrite operations. Affected versions span multiple release branches from 11.1.0 through 13.2.0. Rockwell Automation has released patched versions for all affected branches. This vulnerability was disclosed by CISA on August 29, 2024.

Vendor: Rockwell Automation
Product: ThinManager ThinServer
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-08-29
Original CVE updated: 2024-08-29
Advisory published: 2024-08-29
Advisory updated: 2024-08-29

Who should care

Organizations operating Rockwell Automation ThinManager ThinServer in industrial environments, particularly manufacturing, energy, and critical infrastructure sectors where thin client management systems are deployed. System administrators responsible for OT/ICS security and patch management should prioritize remediation.

Technical summary

CVE-2024-7988 is a remote code execution vulnerability in Rockwell Automation ThinManager ThinServer caused by improper input validation that allows arbitrary file overwrite. An unauthenticated attacker can exploit this to execute arbitrary code with System privileges. The vulnerability affects ThinServer versions 11.1.0-11.1.6, 11.2.0-11.2.7, 12.0.0-12.0.5, 12.1.0-12.1.6, 13.0.0-13.0.3, 13.1.0-13.1.1, and 13.2.0. Rockwell Automation has released patched versions for all affected release branches. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) with network attack vector, low attack complexity, and no privileges or user interaction required.

Defensive priority

critical

Recommended defensive actions

Upgrade ThinManager ThinServer to patched versions: 11.1.8, 11.2.9, 12.0.7, 12.1.8, 13.0.5, 13.1.3, or 13.2.2 (or newer)
Apply network segmentation to restrict ThinServer access to authorized administrative hosts only
Implement defense-in-depth controls per CISA ICS recommended practices
Review and apply Rockwell Automation security best practices guidance
Monitor for unauthorized file system modifications on ThinServer hosts

Evidence notes

Vulnerability description and affected product versions derived from CISA CSAF advisory ICSA-24-242-01. CVSS 3.1 score of 9.8 (Critical) confirmed from source. Remediation guidance including specific patched versions provided by vendor through CISA advisory.

Official resources

2024-08-29