all InfoSec news
Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities
Tenable Research Advisories www.tenable.com
CVE-2024-5988 - Message Type 20 Unauthenticated Remote Code Execution (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
An unauthenticated remote attacker can send a specifically crafted synchronization message of type 20 to execute a Tcl command, which can invoke a local or remote executable under the security context of SYSTEM.
CVE-2024-5989 - Message Type 11 Unauthenticated Database Manipulation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
An unauthenticated remote attacker can send a specifically crafted synchronization message of type 11 to issue SQL statements to the ThinManager database. …
attacker automation can code code execution command context cve cve-2024 cvss database local message remote code remote code execution rockwell rockwell automation security send synchronization system tcl thinmanager unauthenticated under vulnerabilities