high8.8
CVE-2025-9065
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization.
Impact
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rockwellautomation | Thinmanager | from 13.0.0 through 14.0.0 |