CVE-2025-3618

Published: Apr 15, 2025Modified: Jun 17, 2026

8.5

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: PSIRT@rockwellautomation.com (Secondary)

Description

A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while processing Type 18 messages. If exploited, a threat actor could cause a denial-of-service on the target software.

Affected (7)

Products: Rockwellautomation: Thinmanager

Rockwellautomation

1 product

Thinmanager

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Rockwellautomation Thinmanager	version < 11.2.11
Rockwellautomation Thinmanager	12.0.0 ≤ version < 12.0.9
Rockwellautomation Thinmanager	12.1.0 ≤ version < 12.1.10
Rockwellautomation Thinmanager	13.0.0 ≤ version < 13.0.7
Rockwellautomation Thinmanager	13.1.0 ≤ version < 13.1.5
Rockwellautomation Thinmanager	13.2.0 ≤ version < 13.2.4
Rockwellautomation Thinmanager	14.0.0 ≤ version < 14.0.2

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (1)

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.html

Source: PSIRT@rockwellautomation.com

Vendor Advisory

Timeline

No history available yet.