CVE-2023-2915

CVE-2023-2915 is a critical path traversal vulnerability affecting Rockwell Automation ThinManager Thinserver. This flaw, stemming from improper input validation, allows an unauthenticated remote attacker to delete arbitrary files with system privileges, potentially leading to a denial-of-service condition. With a CVSS score of 9.1 (CRITICAL) and a FAUCET Risk Score of 96/100, the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high impact to integrity and availability. While not currently on CISA's KEV catalog, a Metasploit module exists for arbitrary file deletion, and it has garnered significant community discussion and media coverage, indicating active awareness and potential for exploitation.