CVE-2025-3617: ThinManager Privilege Escalation Flaw

CVE-2025-3617 Overview

CVE-2025-3617 is a privilege escalation vulnerability in Rockwell Automation ThinManager. The flaw stems from insecure handling of temporary files during software startup. When ThinManager launches, it deletes files in its temporary folder. This action causes the Access Control Entry (ACE) of the directory to inherit permissions from the parent directory. A local authenticated attacker can abuse this behavior to inherit elevated privileges on the host. The weakness maps to [CWE-276] Incorrect Default Permissions. Rockwell Automation ThinManager is widely deployed to manage thin clients in industrial and operational technology (OT) environments, making privilege escalation on these hosts a meaningful risk to plant-floor operations.

Critical Impact
A local, low-privileged attacker on a ThinManager host can gain elevated privileges by leveraging inherited directory permissions, potentially enabling full control of an OT management server.

Affected Products

Rockwell Automation ThinManager (see vendor advisory for fixed versions)
Industrial and OT environments using ThinManager for thin client management
Windows hosts running the vulnerable ThinManager service

Discovery Timeline

2025-04-15 - CVE-2025-3617 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3617

Vulnerability Analysis

The vulnerability occurs during the ThinManager service startup routine. On initialization, ThinManager clears its temporary working directory by deleting existing files. This deletion operation triggers a permission inheritance behavior: the directory's Access Control Entries are reset to inherit from the parent folder. If the parent grants broader access than intended, the temporary directory ends up with permissive ACLs. A local attacker with limited privileges can then write, replace, or plant files in a location subsequently used by the privileged ThinManager service. The attack requires local access and low privileges, with no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected host. Because ThinManager typically runs with high privileges to manage thin client sessions, gaining code execution in that context yields administrative control.

Root Cause

The root cause is improper permission management on a service-controlled temporary directory ([CWE-276]). The ACE reset on file deletion allows unintended permission inheritance from the parent directory, breaking the isolation expected between a privileged service and unprivileged local users.

Attack Vector

Exploitation requires local access to a system running ThinManager with valid low-privileged credentials. The attacker monitors or triggers the ThinManager startup sequence, then leverages the inherited permissions on the temporary folder to plant or modify files that the service consumes with elevated rights. See the Rockwell Automation Security Advisory SD1727 for vendor-specific technical details.

No public proof-of-concept code is available for this issue. The vulnerability mechanism is described in prose only, consistent with the vendor advisory.

Detection Methods for CVE-2025-3617

Indicators of Compromise

Unexpected files or executables written to the ThinManager temporary directory by non-service accounts
Modification of ACLs on ThinManager working directories outside of installer or update events
New local administrator accounts or privilege changes correlated with ThinManager service restarts
Unexpected child processes spawned by the ThinManager service under SYSTEM or administrative context

Detection Strategies

Monitor file creation and deletion events in ThinManager's temporary folder using Windows Security event IDs 4663 and 4670
Audit ACL changes on ThinManager installation and working directories
Alert on ThinManager service restarts followed by privilege-related events on the same host
Correlate local logon events by low-privileged users with subsequent process executions in ThinManager's context

Monitoring Recommendations

Enable object access auditing on %ProgramData% and ThinManager application directories
Baseline the expected file set in ThinManager temporary folders and alert on deviations
Forward endpoint telemetry to a centralized platform for correlation across ThinManager hosts in OT environments
Track service account activity and flag any interactive logons to ThinManager servers

How to Mitigate CVE-2025-3617

Immediate Actions Required

Apply the fixed ThinManager version listed in Rockwell Automation advisory SD1727
Restrict local logon rights on ThinManager servers to administrators and required service accounts only
Review and tighten ACLs on ThinManager installation, temporary, and parent directories
Inventory ThinManager instances across OT networks and prioritize patching internet-adjacent and shared hosts

Patch Information

Rockwell Automation has released fixed versions of ThinManager. Refer to the vendor advisory SD1727 for the specific fixed release and upgrade guidance. Verify patch application by confirming the installed ThinManager version after update.

Workarounds

Limit local interactive access to ThinManager hosts to trusted administrators only
Harden ACLs on the ThinManager parent directory so that inherited permissions do not grant write access to standard users
Isolate ThinManager servers within a dedicated OT management VLAN with strict access control
Monitor and log all file system changes within ThinManager working directories until the patch is applied

bash

# Example: audit and tighten permissions on ThinManager parent directory (Windows)
icacls "C:\ProgramData\Rockwell\ThinManager" /inheritance:r
icacls "C:\ProgramData\Rockwell\ThinManager" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\ProgramData\Rockwell\ThinManager" /remove "Users" "Authenticated Users"