CVE-2023-2914 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy

What is CVE-2023-2914?

CVE-2023-2914 is a high-severity vulnerability in Rockwell Automation ThinManager ThinServer, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected products. When the ThinManager processes incoming messages, a read access violation occurs and terminates the process. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and causing a denial of service condition in the software.

Weakness: CWE-190, CWE-20

Which versions are affected by CVE-2023-2914?

It affects 1 product.

Products include Rockwellautomation Thinmanager Thinserver.

How do I fix CVE-2023-2914?

No fix has been published for CVE-2023-2914 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2914 being exploited?

There is no known exploitation of CVE-2023-2914 in the wild and no public exploit code.

Other vulnerabilities in Rockwell Automation ThinManager ThinServer

• CVE-2023-2917 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability Critical 9.8
• CVE-2024-7988 ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities Critical 9.3
• CVE-2024-7987 Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities High 8.5
• CVE-2023-2915 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hc2h-534m-88fw.