PT-2023-3018 · Rockwell Automation · Rockwell Automation Thinmanager

Published 2023-05-11 · Updated 2023-05-20 · CVE-2023-2443

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rockwell Automation ThinManager (affected versions not specified)

Description The issue is related to the use of medium strength ciphers in the Rockwell Automation ThinManager product. If a client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API. This is due to insufficient encryption strength, which could allow a remote attacker to compromise the target system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2023-03082

CVE-2023-2443

Affected Products

Rockwell Automation Thinmanager

References · 8

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2443 · Security Note
• https://bdu.fstec.ru/vul/2023-03082 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2443 · Vendor Advisory
• https://t.me/cvenotify/50827 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023051215 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-15 · Note
• https://t.me/cibsecurity/63909 · Telegram Post