CVE-2023-27856: Rockwell Automation ThinManager ThinServer Path Traversal Download

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 77.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-22 · updated 2026-06-17
Weakness: CWE-22

Description

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.

Affected products

Rockwell Automation ThinManager ThinServer: from 6.0.0 through 10.0.2; from 11.0.0 through 11.0.5; from 11.1.0 through 11.1.5; from 11.2.0 through 11.2.6; from 12.0.0 through 12.0.4; from 12.1.0 through 12.1.5

References

https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640

Get alerted when CVE-2023-27856 or the next vulnerability affects your stack