CVE-2023-27856

71

FAUCET Score

CVE-2023-27856 is a path traversal vulnerability affecting Rockwell Automation ThinManager ThinServer, specifically when processing a message of type 8. This allows an unauthenticated remote attacker to download arbitrary files from the disk drive where ThinServer.exe is installed. Rated as High severity (CVSS 7.5), it requires no user interaction and has a high impact on confidentiality. While not currently on CISA's KEV list or the Hot List, a Metasploit module exists for exploitation, indicating readily available exploit code, despite minimal community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 6.0.0, <= 10.0.2CPE matchmatch criteria	cpe:2.3:a:rockwellautomation:thinmanager::::::::
		>= 11.0.0, <= 11.0.5CPE matchmatch criteria	cpe:2.3:a:rockwellautomation:thinmanager::::::::
		>= 11.1.0, <= 11.1.5CPE matchmatch criteria	cpe:2.3:a:rockwellautomation:thinmanager::::::::
		>= 11.2.0, <= 11.2.6CPE matchmatch criteria	cpe:2.3:a:rockwellautomation:thinmanager::::::::
		>= 12.0.0, <= 12.0.4CPE matchmatch criteria	cpe:2.3:a:rockwellautomation:thinmanager::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

77.22%

Probability of exploitation in next 30 days

EPSS Percentile

99.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

Metasploit: ThinManager Path Traversal (CVE-2023-27856) Arbitrary File Download · Apr 5, 2023

This CVE's current EPSS score of 0.7722 is in the 99th percentile among its peer group of 51,551 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

bentomlpatch availablevia llm_extracted

Fixed in: 11.0.6, 11.1.6, 11.2.7, 12.0.5, 12.1.6, 13.0.2

jfrogvendor investigatingvia llm_extracted

lfedgevendor investigatingvia llm_extracted

linkacevendor investigatingvia llm_extracted

markusprojectvendor investigatingvia llm_extracted

Vendor Advisories (5)

jfrogllm-jfrog-9f95974196df67e7CRITICAL

Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities

lfedgellm-lfedge-2246fb2b4ed9fb85CRITICAL

Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities

markusprojectllm-markusproject-1dc1d35e2f413a2cCRITICAL

Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities

linkacellm-linkace-e0e37a1015d6729aCRITICAL

Rockwell Automation ThinManager ThinServer Multiple Vulnerabilities

bentomlllm-bentoml-5b3ebc99e0b683f2

Multiple Vulnerabilities in ThinManager ThinServer software

References

rockwellautomation.custhelp.com / app/answers/answer_view/a_id/1138640

Permissions RequiredVendor Advisory