In a significant security development, vulnerabilities within Rockwell Automation’s ThinManager ThinServer have been uncovered, raising concerns about potential attacks on industrial control systems (ICS).
Furthermore, researchers from cybersecurity firm Tenable identified one critical and two high-severity vulnerabilities, designated as CVE-2023-2914, CVE-2023-2915, and CVE-2023-2917. These flaws, arising from improper input validation, create avenues for remote attackers to exploit the software without requiring prior authentication, using specially crafted synchronization protocol messages. The repercussions of these vulnerabilities encompass creating denial-of-service conditions, deleting files with system privileges, and uploading arbitrary files to the ThinServer.exe drive folder.
Prompted by the discovery, Tenable reported the vulnerabilities to Rockwell Automation in May. On August 17, the same day Rockwell Automation communicated patch availability to its registered users, Tenable released technical details of the vulnerabilities.
Additionally, despite developing proof-of-concept (PoC) exploits, Tenable refrained from public disclosure. The vulnerabilities can be exploited with access to the network housing the vulnerable server, and in certain cases, even directly from the internet, though this contradicts vendor-recommended best practices.
The ramifications of successful exploitation of the vulnerabilities are substantial. Attackers could assume control of ThinServer, potentially affecting the entire environment and allowing pivoting to target other network assets.
Highlighting the relevance of this issue, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory to organizations about these vulnerabilities. The broader context of threats targeting industrial systems is underscored by the recent revelation that an unnamed APT has shown interest in exploiting vulnerabilities within Rockwell Automation products, potentially putting critical infrastructure organizations at risk.
