{"id":"CVE-2023-27857","aliases":["EUVD-2023-31592","GHSA-pr5c-7q57-fp6g"],"status":"published","title":"Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow","description":"In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field\n\n\n\n in Rockwell Automation's ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.18335,"percentile":0.97264,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2023-03-22T00:00:18Z","modified":"2026-06-17T05:45:58Z","products":[{"vendor":"rockwell automation","product":"thinmanager thinserver"},{"vendor":"rockwellautomation","product":"thinmanager"}],"references":[{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27857"},{"url":"https://github.com/advisories/GHSA-pr5c-7q57-fp6g"}],"sources":{"cve":[{"id":"CVE-2023-27857","title":"Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow","description":"\n In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field\n\n\n\n in Rockwell Automation's ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.\n\n\n\n \n\n","status":"published","published":"2023-03-22T00:00:18.344Z","modified":"2024-10-21T16:02:48.552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31592","description":"\n In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field\n\n\n\n in Rockwell Automation's ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.\n\n\n\n \n\n","status":"published","published":"2023-03-22T00:00:18Z","modified":"2024-10-21T16:02:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:32.038051Z"}],"ghsa":[{"id":"GHSA-pr5c-7q57-fp6g","title":"In affected versions, a heap-based buffer over-read condition occurs when the message field...","description":"In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.","status":"published","published":"2023-03-22T03:30:15Z","modified":"2023-04-06T05:10:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:27.289188Z"}],"nvd":[{"id":"CVE-2023-27857","description":"\n In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field\n\n\n\n in Rockwell Automation's ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.\n\n\n\n \n\n","status":"published","published":"2023-03-22T02:15:48.953Z","modified":"2026-06-17T05:45:58.62Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:50.908252Z"}]}}