Rockwell ThinManager SSRF Vulnerability

An attacker could use ThinManager to make unauthorized requests to internal systems on your network, potentially accessing sensitive data, internal monitoring systems, or other connected infrastructure without needing direct network access to those systems.

Organizations operating Rockwell ThinManager for thin client terminal management and remote access should be concerned. This affects any facility using ThinManager for operator station management, HMI access, or remote monitoring across manufacturing, water treatment, utility operations, or any industrial environment where ThinManager provides terminal services.

An attacker exploits the SSRF vulnerability by crafting a malicious request to ThinManager that causes it to make an outbound request to an internal system (such as a local database, API, or monitoring service). The request originates from ThinManager's network context, bypassing network access controls that would normally block external access to those internal systems.