CVE-2025-9065

Summary

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.

Affected Software

Weaknesses

• CWE-610: CWE-610: Externally Controlled Reference to a Resource in Another Sphere

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1743.html

• ←Previous
• Next→