Rockwell Automation ThinManager

An attacker with local access to a ThinManager device could escalate privileges and run arbitrary commands, potentially disrupting remote access to your thin clients and control network devices or denying service to connected equipment.

Water utilities and electric utilities using Rockwell Automation ThinManager for remote device management and thin client control. ThinManager is commonly used to manage remote access to PLCs, RTUs, and HMIs in water treatment plants and substations.

An attacker must first gain local access to the ThinManager workstation (via physical access, compromised account, or initial remote compromise). Once local, they exploit a privilege escalation vulnerability to run commands as a higher-privilege user, which could disrupt ThinManager's ability to manage remote devices or cause the service to crash.