Vulnerability record · CVE-2023-2917 · published 17 August 2023
CVE-2023-2917: Rockwell ThinManager ThinServer path traversal allows unauthenticated file upload
Rockwellautomation · Thinmanager Thinserver
ThinManager ThinServer fails to validate the filename field, allowing path traversal when processing a synchronization protocol message. An unauthenticated remote attacker can write arbitrary files to any directory on the drive where ThinServer.exe is installed, which the advisory says can lead to remote code execution.
Description
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this a high-risk, remotely exploitable flaw.
What it is
ThinManager ThinServer fails to validate the filename field, allowing path traversal when processing a synchronization protocol message. An unauthenticated remote attacker can write arbitrary files to any directory on the drive where ThinServer.exe is installed, which the advisory says can lead to remote code execution.
Impact
An attacker gains the ability to upload arbitrary files anywhere on the ThinServer installation drive, potentially achieving remote code execution. This can compromise the ThinManager server and any clients or managed devices it controls.
Attack surface
Reachable over the network via the synchronization protocol; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). No authentication is needed to send the crafted message.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high (0.72, 99.4th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the vendor fix from Rockwell Automation advisory 1140471 as soon as possible.
- Restrict network access to ThinServer synchronization ports to trusted hosts only.
- Segment ThinManager servers from general IT and internet-facing networks.
- Monitor the ThinServer installation drive for unexpected new or modified files.
- If patching is delayed, consider disabling or blocking the synchronization service where operationally feasible.
Detection
- Alert on unexpected file creation or modification in ThinServer.exe directories and system paths on ThinManager hosts.
- Monitor network traffic for anomalous synchronization protocol messages containing path traversal sequences in filename fields.
- Review ThinManager and Windows event logs for unusual file write or process execution activity on the server.
- Baseline normal file activity on the ThinServer drive and alert on deviations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471 | Permissions Required |
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471 | Permissions Required |
Track CVE-2023-2917 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-2917), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
