High severity · published Apr 15, 2025
CVE-2025-3617
Local Privilege Escalation in ThinManager®
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TH
ThinManager® · Rockwell Automation
14.0.0 & 14.0.1 · source: vendor
TH
Thinmanager · Rockwellautomation
14.0.0 before 14.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3617
Vendor Advisory
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.html
More from ThinManager®
8.8
CVE-2025-9065
Rockwell Automation ThinManager® Server-Side Request Forgery Vulnerability
8.8
CVE-2024-45826
ThinManager® Code Execution Vulnerability
5.5
CVE-2025-3618
Local Privilege Escalation Vulnerability