{"id":"CVE-2024-5990","state":"PUBLISHED","title":"ThinManager® ThinServer™ Improper Input Validation Vulnerability","description":"Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected device.","publishedAt":"2024-06-25T16:11:01.407Z","updatedAt":"2025-08-27T20:42:59.671Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation ThinManager® ThinServer™"],"affected":[{"vendor":"Rockwell Automation","product":"ThinManager® ThinServer™","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"},{"version":"11.2.0","status":"affected"},{"version":"12.0.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"13.0.0","status":"affected"},{"version":"13.1.0","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5990.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5990","state":"PUBLISHED","datePublished":"2024-06-25T16:11:01.407Z","dateUpdated":"2025-08-27T20:42:59.671Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2024-06-13T20:56:10.603Z"},"containers":{"cna":{"title":"ThinManager® ThinServer™ Improper Input Validation Vulnerability","descriptions":[{"lang":"en","value":"Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected device."}],"affected":[{"vendor":"Rockwell Automation","product":"ThinManager® ThinServer™","defaultStatus":"unaffected","versions":[{"version":"11.1.0","status":"affected"},{"version":"11.2.0","status":"affected"},{"version":"12.0.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"13.0.0","status":"affected"},{"version":"13.1.0","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2024-06-25T16:11:01.407Z"},"datePublic":"2024-06-25T13:00:00.000Z","impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n

Affected Product

CVE

First Known in software version

Corrected in software version (Available Here)

ThinManager® ThinServer™

2024-5988

2024-5989

 

 

 

 

 

11.1.0

11.2.0

12.0.0

12.1.0

13.0.0

13.1.0

13.2.0

11.1.8

11.2.9

12.0.7

12.1.8

13.0.5

13.1.3

13.2.2

2024-5990

11.1.0

11.2.0

12.0.0

12.1.0

13.0.0

13.1.0

11.1.8

11.2.9

12.0.7

12.1.8

13.0.4

13.1.2

\n\n

Customers using the affected software are encouraged to apply the risk mitigations from the list below, if possible. Additionally, we encourage customers to implement our suggested security best practices to minimize the potential risk of vulnerability.

·Update to the corrected software versions via the ThinManager® Downloads Site

·Limit remote access for TCP Port 2031 to known thin clients and ThinManager® servers.

· Security Best Practices

\n\n


"}],"value":"Affected Product\n\nCVE\n\nFirst Known in software version\n\nCorrected in software version ( Available Here https://thinmanager.com/downloads/index.php )\n\nThinManager® ThinServer™\n\n2024-5988\n\n2024-5989\n\n \n\n \n\n \n\n \n\n \n\n11.1.0\n\n11.2.0\n\n12.0.0\n\n12.1.0\n\n13.0.0\n\n13.1.0\n\n13.2.0\n\n 11.1.8 https://thinmanager.com/downloads/index.php \n\n 11.2.9 https://thinmanager.com/downloads/index.php \n\n 12.0.7 https://thinmanager.com/downloads/index.php \n\n 12.1.8 https://thinmanager.com/downloads/index.php \n\n 13.0.5 https://thinmanager.com/downloads/index.php \n\n 13.1.3 https://thinmanager.com/downloads/index.php \n\n 13.2.2 https://thinmanager.com/downloads/index.php \n\n2024-5990\n\n11.1.0\n\n11.2.0\n\n12.0.0\n\n12.1.0\n\n13.0.0\n\n13.1.0\n\n 11.1.8 https://thinmanager.com/downloads/index.php \n\n 11.2.9 https://thinmanager.com/downloads/index.php \n\n 12.0.7 https://thinmanager.com/downloads/index.php \n\n 12.1.8 https://thinmanager.com/downloads/index.php \n\n 13.0.4 https://thinmanager.com/downloads/index.php \n\n 13.1.2 https://thinmanager.com/downloads/index.php \n\n\n\n\n\nCustomers using the affected software are encouraged to apply the risk mitigations from the list below, if possible. Additionally, we encourage customers to implement our suggested security best practices to minimize the potential risk of vulnerability.\n\n·Update to the corrected software versions via the ThinManager® Downloads Site https://thinmanager.com/downloads/index.php \n\n·Limit remote access for TCP Port 2031 to known thin clients and ThinManager® servers.\n\n· Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]},{"vendor":"rockwellautomation","product":"thinmanager","defaultStatus":"unknown","versions":[{"version":"11.1.0","status":"affected","lessThan":"11.1.8","versionType":"custom"},{"version":"11.2.0","status":"affected","lessThan":"11.2.9","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.7","versionType":"custom"},{"version":"12.1.0","status":"affected","lessThan":"12.1.8","versionType":"custom"},{"version":"13.0.0","status":"affected","lessThan":"13.0.4","versionType":"custom"},{"version":"13.1.0","status":"affected","lessThan":"13.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:thinmanager:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:11.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rockwellautomation:thinmanager:13.1.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-5990","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-06-26T13:48:23.344377Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-27T20:42:59.671Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:25:03.210Z"}}]}}}