ThinManager Multiple Vulnerabilities Advisory (CVE-2024-10386/10387)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: SD 1708 2. Severity: High, Critical 3. Vulnerability ID: SD1708 4. Release Date: October 25, 2024 5. Update Date: October 25, 2024 6. Revision Version: 1.0 7. Known Exploited Vulnerabilities (KEV): No 8. Fixed: Yes 9. Workarounds Available: Yes 10. Affected Products: - ThinManager® 11. Affected Versions: - 11.2.0–11.2.9 - 12.0.0–12.0.7 - 12.1.0–12.1.8 - 13.0.0–13.0.5 - 13.1.0–13.1.3 - 13.2.0–13.2.2 - 14.0.0 12. Fixed Versions: - 11.2.10 - 12.0.8 - 12.1.9 - 13.0.6 - 13.1.4 - 13.2.3 - 14.0.1 13. CVE IDs: - CVE-2024-10386 - CVE-2024-10387 14. Download Links: - CVE-2024-10386 - CVE-2024-10387 15. Vulnerability Details: - CVE-2024-10386: Authentication vulnerability that could allow an attacker with network access to send crafted messages to the device, potentially leading to database tampering. - CVE-2024-10387: Denial of Service (DoS) vulnerability that could allow an attacker with network access to send crafted messages to the device, potentially leading to a denial of service. 16. Mitigations and Workarounds: - If possible, navigate to the ThinManager® download website and upgrade to a fixed version. - Implement network hardening by restricting TCP 2031 communication between ThinManager® devices. - For information on mitigating security risks in industrial automation control systems, customers are encouraged to implement our recommended security best practices to minimize the risk of exploitation. - Customers can use Stakeholder-Specific Vulnerability Categorization to generate more specific environment-based prioritization. This information provides a detailed description of the ThinManager® vulnerabilities, including severity, affected and fixed versions, and mitigation strategies.

Goal Reached Thanks to every supporter — we hit 100%!

ThinManager Multiple Vulnerabilities Advisory (CVE-2024-10386/10387)