PT-2023-2367 · Rockwell Automation · Modbus Tcp Server Aoi

Published 2023-03-16 · Updated 2023-03-23 · CVE-2023-0027

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rockwell Automation Modbus TCP Server AOI versions prior to 2.04.00

Description The issue is related to the lack of protection for service data. An unauthorized user can send a malformed message, causing the controller to respond with a copy of the most recent response to the last valid request. If exploited, this could allow an unauthorized user to read the connected device's Modbus TCP Server AOI information.

Recommendations For versions prior to 2.04.00, update to version 2.04.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the Modbus TCP Server AOI to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-02142

CVE-2023-0027

Affected Products

Modbus Tcp Server Aoi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-0027 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138766 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02142 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0027 · Vendor Advisory
• https://t.me/cvenotify/46725 · Telegram Post
• https://t.me/cibsecurity/60263 · Telegram Post