Rockwell Local Privilege Escalation and denial-of-service Vulnerability in ThinManager®

An attacker with local access to a ThinManager workstation could escalate privileges to system level, potentially modifying HMI configurations, altering process controls, or disrupting visualization of plant operations. Denial-of-service conditions could interrupt monitoring and control of critical equipment.

Operators and IT staff at water utilities, electric utilities, and manufacturing plants using Rockwell ThinManager for HMI visualization and control should assess their deployment. ThinManager is commonly used to remotely monitor and control PLCs and other control devices in industrial environments. Any facility where an operator workstation is shared among multiple users or where local console access is not strictly controlled faces elevated risk.

An attacker with local user account access to a ThinManager workstation exploits a privilege escalation flaw to gain system-level privileges. From there, they can modify HMI configurations, interfere with process control commands sent to PLCs, or crash the ThinManager service to disrupt operator visibility and control.