CVE-2023-27857: high-severity vulnerability in Rockwell Automation ThinManager ThinServer
Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
26Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 18%
In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field
in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Rockwell Automation · ThinManager ThinServerRelated CVEs — Rockwell Automation ThinManager ThinServer
In the same product, most dangerous first.
CVE-2023-2915HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 81.8%CVE-2023-27856HIGHRockwell Automation ThinManager ThinServer Path Traversal DownloadEPSS 77.2%CVE-2023-2917CRITICALRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 72.2%CVE-2023-2914HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyEPSS 39.9%CVE-2022-38742HIGHRockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service AttackEPSS 22.7%CVE-2023-27855CRITICALRockwell Automation ThinManager ThinServer Path Traversal UploadEPSS 13.5%