Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-9065

Rockwell Automation ThinManager® Server-Side Request Forgery Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Rockwell

Description

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rockwell Automation ThinManager

Default version status: unaffected

  • 13.0 - 14.0affected

References