TCP: Rockwell Automation ThinManager ThinServer.exe Directory Traversal
This signature detects attempts to exploit a known vulnerability against Rockwell Automation ThinManager. A successful attack can lead to directory traversal and arbitrary code execution.
Extended Description
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.
Affected Products
Rockwellautomation thinmanager
Short Name
TCP:C2S:ROCKWELL-THIN-DIR-TRAV
Severity
Major
Recommended
False
Recommended Action
Drop
Category
TCP
Keywords
Automation CVE-2023-27856 CVE-2023-2917 Directory Rockwell ThinManager ThinServer.exe Traversal
Release Date
05/24/2023
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3650
Port
TCP/2031
False Positive
Unknown
Vendors
Rockwellautomation