dbcve.org
ThinmanagerApplication · Rockwellautomation

CVE-2025-3617

HIGH · 7.8 CVSS v3.1 Published 2025-04-15
Fix available
A fix is available. Upgrade to 14.0.2 or later.
See remediation →
80/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is a privilege escalation vulnerability in Rockwell Automation ThinManager where the application, during startup, deletes files in a temporary folder. This file deletion operation causes the Access Control Entry (ACE) of the directory to inherit permissions from the parent directory rather than maintaining its own secure permissions. An attacker who can place files in or control this temporary directory could exploit the inherited elevated permissions to gain higher privileges on the system.

MitigationApply the vendor patch when released by Rockwell Automation. Until then, restrict access to ThinManager temporary folders to only privileged administrators, run ThinManager with least privilege, and ensure proper network segmentation per ISA-62443 guidelines.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
ThinmanagerApplication
Affected:>= 14.0.0, < 14.0.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm ThinManager installation and version
    Locate ThinManager installation directory or check installed programs, then identify the version number from the application or its metadata
    Affected if The installed version is >= 14.0.0 and < 14.0.2
  2. Identify the temporary folder used by ThinManager
    Monitor ThinManager during startup or review application documentation to locate the temporary folder it uses for file deletion operations
    Affected if A temporary folder exists and is used by ThinManager during startup for file operations
  3. Verify permissions on the temporary folder
    Inspect the Access Control Entries (ACE) on the temporary folder and compare them to the parent directory permissions
    Affected if The temporary folder permissions inherit from the parent directory rather than maintaining independent restrictive permissions
  4. Test write access to the temporary folder
    Attempt to create or place files in the temporary folder using a non-privileged account
    Affected if Non-privileged or low-privilege users can write files to or control the contents of the ThinManager temporary folder

You are affected if ThinManager version is between 14.0.0 and 14.0.2 exclusive, and non-privileged users can write to the temporary folder that ThinManager uses during startup.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 14.0.2 or later
Fixed in 14.0.2
Interim mitigation

Apply the vendor patch when released by Rockwell Automation. Until then, restrict access to ThinManager temporary folders to only privileged administrators, run ThinManager with least privilege, and ensure proper network segmentation per ISA-62443 guidelines.

Recommended fix High confidence

ThinManager 14.0.2

  1. 1. Back up all ThinManager configuration data and settings before proceeding with the upgrade
  2. 2. Download ThinManager version 14.0.2 from the official Rockwell Automation website or support portal
  3. 3. Install the ThinManager 14.0.2 upgrade on the affected system
  4. 4. After installation, verify that the software starts correctly and that temporary folder permissions are properly configured
  5. 5. Test ThinManager functionality in a non-production environment before deploying to production systems
Caveat Test the upgrade in a non-production environment first to ensure compatibility with existing configurations and integrations

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Thinmanager Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-3617 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-3617 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data