{"id":"CVE-2024-5988","state":"PUBLISHED","title":"Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability","description":"Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™.","publishedAt":"2024-06-25T15:53:33.899Z","updatedAt":"2025-08-27T20:42:59.382Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation ThinManager® ThinServer™"],"affected":[{"vendor":"Rockwell Automation","product":"ThinManager® ThinServer™","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"},{"version":"11.2.0","status":"affected"},{"version":"12.0.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"13.0.0","status":"affected"},{"version":"13.1.0","status":"affected"},{"version":"13.2.0","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5988.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5988","state":"PUBLISHED","datePublished":"2024-06-25T15:53:33.899Z","dateUpdated":"2025-08-27T20:42:59.382Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2024-06-13T20:56:08.636Z"},"containers":{"cna":{"title":"Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability","descriptions":[{"lang":"en","value":"Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™."}],"affected":[{"vendor":"Rockwell Automation","product":"ThinManager® ThinServer™","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"},{"version":"11.2.0","status":"affected"},{"version":"12.0.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"13.0.0","status":"affected"},{"version":"13.1.0","status":"affected"},{"version":"13.2.0","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2024-06-25T16:03:05.556Z"},"datePublic":"2024-06-25T13:00:00.000Z","impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Affected Product

CVE

First Known in software version

Corrected in software version (Available Here)

ThinManager® ThinServer™

2024-5988

2024-5989

 

 

 

 

 

11.1.0

11.2.0

12.0.0

12.1.0

13.0.0

13.1.0

13.2.0

11.1.8

11.2.9

12.0.7

12.1.8

13.0.5

13.1.3

13.2.2

2024-5990

11.1.0

11.2.0

12.0.0

12.1.0

13.0.0

13.1.0

11.1.8

11.2.9

12.0.7

12.1.8

13.0.4

13.1.2

\n\n
\n\n

Customers using the affected software are encouraged to apply the risk mitigations from the list below, if possible. Additionally, we encourage customers to implement our suggested security best practices to minimize the potential risk of vulnerability.

· Update to the corrected software versions via the ThinManager® Downloads Site

· Limit remote access for TCP Port 2031 to known thin clients and ThinManager® servers.

· Security Best Practices

 

\n\n
"}],"value":"Affected Product\n\nCVE\n\nFirst Known in software version\n\nCorrected in software version ( Available Here https://thinmanager.com/downloads/index.php )\n\nThinManager® ThinServer™\n\n2024-5988\n\n2024-5989\n\n \n\n \n\n \n\n \n\n \n\n11.1.0\n\n11.2.0\n\n12.0.0\n\n12.1.0\n\n13.0.0\n\n13.1.0\n\n13.2.0\n\n 11.1.8 https://thinmanager.com/downloads/index.php \n\n 11.2.9 https://thinmanager.com/downloads/index.php \n\n 12.0.7 https://thinmanager.com/downloads/index.php \n\n 12.1.8 https://thinmanager.com/downloads/index.php \n\n 13.0.5 https://thinmanager.com/downloads/index.php \n\n 13.1.3 https://thinmanager.com/downloads/index.php \n\n 13.2.2 https://thinmanager.com/downloads/index.php \n\n2024-5990\n\n11.1.0\n\n11.2.0\n\n12.0.0\n\n12.1.0\n\n13.0.0\n\n13.1.0\n\n 11.1.8 https://thinmanager.com/downloads/index.php \n\n 11.2.9 https://thinmanager.com/downloads/index.php \n\n 12.0.7 https://thinmanager.com/downloads/index.php \n\n 12.1.8 https://thinmanager.com/downloads/index.php \n\n 13.0.4 https://thinmanager.com/downloads/index.php \n\n 13.1.2 https://thinmanager.com/downloads/index.php \n\n\n\n\n\n\nCustomers using the affected software are encouraged to apply the risk mitigations from the list below, if possible. Additionally, we encourage customers to implement our suggested security best practices to minimize the potential risk of vulnerability.\n\n· Update to the corrected software versions via the ThinManager® Downloads Site https://thinmanager.com/downloads/index.php \n\n· Limit remote access for TCP Port 2031 to known thin clients and ThinManager® servers.\n\n· Security  Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"},{"version":"13.2.0","status":"affected","lessThan":"13.2.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.2.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-5988","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-06-26T13:49:49.088552Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-27T20:42:59.382Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:25:03.324Z"}}]}}}