Vulnerability record · CVE-2023-2915 · published 17 August 2023
CVE-2023-2915: Rockwell ThinManager ThinServer path traversal allows unauthenticated file deletion
Rockwellautomation · Thinmanager Thinserver
Rockwell Automation ThinManager ThinServer fails to properly validate input when processing a specific synchronization protocol message, creating a path traversal condition. An unauthenticated remote attacker can delete arbitrary files with system privileges, which can degrade or halt ThinManager operations.
Description
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unauthenticated remote threat actor can delete arbitrary files with system privileges. A malicious user could exploit this vulnerability by sending a specifically crafted synchronization protocol message resulting in a denial-of-service condition.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Automated analysis
critical priorityCVSS 9.1 with unauthenticated remote file deletion and very high EPSS make this a high-urgency issue despite no KEV listing.
What it is
Rockwell Automation ThinManager ThinServer fails to properly validate input when processing a specific synchronization protocol message, creating a path traversal condition. An unauthenticated remote attacker can delete arbitrary files with system privileges, which can degrade or halt ThinManager operations.
Impact
An attacker gains the ability to delete arbitrary files on the ThinServer host with system privileges, causing denial of service and potentially disrupting managed thin-client infrastructure.
Attack surface
The flaw is reachable over the network via the synchronization protocol; the CVSS vector shows no privileges or user interaction required (PR:N, UI:N), so it is unauthenticated and remotely triggerable.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.81828, 99.6th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the Rockwell Automation fix referenced in advisory a_id/1140471 as the first action.
- Restrict network access to ThinManager synchronization protocol ports to trusted management hosts only.
- Segment ThinServer hosts from general user and internet-facing networks.
- Monitor and back up critical ThinServer files so deletions can be restored quickly.
- Review Rockwell guidance for any interim workarounds if patching cannot be done immediately.
Detection
- Alert on unexpected deletion or disappearance of files in ThinManager/ThinServer directories.
- Monitor for anomalous synchronization protocol traffic, especially malformed or traversal-style path strings.
- Correlate file-deletion events with inbound network connections to ThinServer services.
- Watch for service crashes or availability loss on ThinServer hosts that coincide with unusual remote connections.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471 | Permissions Required |
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471 | Permissions Required |
Track CVE-2023-2915 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-2915), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
