CVE-2023-27857

Deeper analysis

CVE-2023-27857 is a heap-based buffer over-read vulnerability in Rockwell Automation ThinManager ThinServer. The flaw is triggered when a message field declares a length greater than the actual data present in the message, leading to an out-of-bounds read (CWE-125) that produces a read access violation and terminates the ThinServer.exe process.

An unauthenticated remote attacker can send a crafted message over the network to exploit the condition. Successful exploitation requires no user interaction or credentials and results in a denial-of-service crash of the ThinServer component, consistent with the CVSS 7.5 rating that reflects high availability impact with no confidentiality or integrity loss.

Vendor guidance is published in the Rockwell Automation knowledge-base articles referenced at the supplied URLs; these advisories describe the affected ThinManager versions and any available remediation steps. The associated EPSS score rose from lower values to a peak of 0.2795 before receding to the current 0.1737, indicating a period of increased exploitation interest after disclosure.