What’s Vulnerable › Vulnerabilities

CVE-2022-38742: Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-23 · updated 2026-06-17
• Weakness: CWE-122

Description

Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.

Affected products

• Rockwell Automation ThinManager ThinServer: from 11.0.0 through 13.0.0

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136847
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136847

Get alerted when CVE-2022-38742 or the next vulnerability affects your stack