Skip to content
OpenAdvisories
Critical ICSA-23-080-06 3 CVEs

Rockwell Automation ThinManager

Published Mar 31, 2023 · Updated Mar 31, 2023

Vendor: Rockwell Automation Product: ThinManager® ThinServer™

Summary

Successful exploitation of these vulnerabilities could allow an attacker to potentially perform remote code execution on the target or crash the software.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-27855 Public exploit EPSS 13%

    Rockwell Automation ThinManager ThinServer Path Traversal Upload

    In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk dri…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • High 7.5
    CVE-2023-27856 Public exploit EPSS 77%

    Rockwell Automation ThinManager ThinServer Path Traversal Download

    In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.e…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • High 7.5
    CVE-2023-27857 EPSS 18%

    Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow

    In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerab…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT

Revision history

  1. #1

    CSAF Creation Date

References