What’s Vulnerable › Vulnerabilities
CVE-2025-3618: Local Privilege Escalation Vulnerability
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-15 · updated 2026-06-17
- Weakness: CWE-119
Description
A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while processing Type 18 messages. If exploited, a threat actor could cause a denial-of-service on the target software.
Affected products
- Rockwell Automation ThinManager ThinServer: before 11.2.11; from 12.0.0 before 12.0.9; from 12.1.0 before 12.1.10; from 13.0.0 before 13.0.7; from 13.1.0 before 13.1.5; from 13.2.0 before 13.2.4 — fixed in 11.2.11, 12.0.9, 12.1.10, 13.0.7, 13.1.5, 13.2.4
How to fix
Upgrade to a fixed version: Rockwell Automation ThinManager ThinServer 11.2.11, 12.0.9, 12.1.10, 13.0.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-3618 or the next vulnerability affects your stack