PT-2023-3018 · Rockwell Automation · Rockwell Automation Thinmanager

Publicado 2023-05-11 · Atualizado 2023-05-20 · CVE-2023-2443

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rockwell Automation ThinManager (affected versions not specified)

Description The issue is related to the use of medium strength ciphers in the Rockwell Automation ThinManager product. If a client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API. This is due to insufficient encryption strength, which could allow a remote attacker to compromise the target system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

BDU:2023-03082

CVE-2023-2443

Produtos afetados

Rockwell Automation Thinmanager

Referências · 8

• https://t.me/cvenotify/50827 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023051215 · Nota
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2443 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-15 · Nota
• https://bdu.fstec.ru/vul/2023-03082 · Nota de Segurança
• https://t.me/cibsecurity/63909 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2443 · Aviso do Fabricante