Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities

There are multiple vulnerabilities in Rockwell Automation ThinManager ThinServer.exe.

Affected Versions:

• 6.x - 10.x


• 11.0.0 - 11.0.5


• 11.1.0 - 11.1.5


• 11.2.0 - 11.2.6


• 12.0.0 - 12.0.4


• 12.1.0 - 12.1.5


• 13.0.0 - 13.0.1

CVE-2023-27855 - ThinManager ThinServer Path Traversal Upload

A client message sent to a synchronization thread in ThinServer.exe has the following structure:

// be = big endian
struct header
{
   be16 type;  // msg type
   be16 flags; // msg flags
               // 0x0001 …