PT-2023-1916 · Rockwell Automation · Thinmanager Thinserver

Security Researchers · Publicado 2023-03-21 · Atualizado 2025-06-09 · CVE-2023-27855

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation's ThinManager ThinServer (affected versions not specified)

Description A path traversal issue exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-01525

CVE-2023-27855

Produtos afetados

Thinmanager Thinserver

Referências · 8

• https://t.me/cibsecurity/60426 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-06 · Nota
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-27855 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27855 · Nota de Segurança
• https://t.me/cvenotify/46608 · Publicação no Telegram
• https://twitter.com/threatsbank/status/1932014812852285655 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-01525 · Nota de Segurança