TI-2023-02735 Aliases CVE-2023-2917 GHSA-g747-9xrw-rcmj

Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

CRITICAL 87CWE-20Published 2023-08-17 · Updated 2024-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.72173 99th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rockwell	ThinManager ThinServer	11.0.0 - 11.2.6; 11.1.0 - 11.1.6; 11.2.0 - 11.2.7; 12.0.0 - 12.0.5; 12.1.0 - 12.1.6; 13.0.0 - 13.0.2; 13.1.0	—	No fix listed	CNA

ThinManager ThinServer VendorRockwell Affected 11.0.0 - 11.2.6; 11.1.0 - 11.1.6; 11.2.0 - 11.2.7; 12.0.0 - 12.0.5; 12.1.0 - 12.1.6; 13.0.0 - 13.0.2; 13.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:rockwellautomation:thinmanager_thinserver::::::::	11.0.0 – 11.0.6; 11.1.0 – 11.1.6; 11.2.0 – 11.2.7; 12.0.0 – 12.0.5; 12.1.0 – 12.1.6; 13.0.0 – 13.0.2	Vulnerable	Rockwell
cpe:2.3:a:rockwellautomation:thinmanager_thinserver:13.1.0:::::::*	13.1.0	Vulnerable	Rockwell

cpe:2.3:a:rockwellautomation:thinmanager_thinserver:*:*:*:*:*:*:*:* Versions 11.0.0 – 11.0.6; 11.1.0 – 11.1.6; 11.2.0 – 11.2.7; 12.0.0 – 12.0.5; 12.1.0 – 12.1.6; 13.0.0 – 13.0.2 Vulnerable ·Rockwell
cpe:2.3:a:rockwellautomation:thinmanager_thinserver:13.1.0:*:*:*:*:*:*:* Versions 13.1.0 Vulnerable ·Rockwell

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-2917
2026-10-03 Alias added: GHSA-g747-9xrw-rcmj

References

Other 1

https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471

TI-2023-02733 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability CVSS 3.1CRITICAL 9.1
TI-2023-02732 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy CVSS 3.1HIGH 7.5
TI-2024-07407 ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities CVSS 4.0CRITICAL 9.3
TI-2024-07406 Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences