CVE-2022-38742 Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack

High 8.1 Published 23 Sep 2022 Updated 22 May 2025

A heap-based buffer overflow in Rockwell Automation ThinServer allows remote attackers to execute arbitrary code or cause a denial-of-service via crafted requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-38742?

CVE-2022-38742 is a high-severity memory corruption vulnerability in Rockwell Automation ThinManager ThinServer, published on 23 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2022-38742?

It affects 1 product.

Products include Rockwellautomation Thinmanager.

How do I fix CVE-2022-38742?

No fix has been published for CVE-2022-38742 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-38742 being exploited?

There is no known exploitation of CVE-2022-38742 in the wild and no public exploit code.

Sources

Also known as GHSA-rvg5-w7ph-h5wx.