CVE-2023-2915

What it actually does

This is an unauthenticated, network-reachable path traversal vulnerability in Rockwell Automation ThinManager ThinServer. The ThinServer synchronization protocol fails to properly validate attacker-controlled path input, allowing a remote attacker to reference files outside the intended directory. Successful exploitation can cause arbitrary file deletion with the privileges of the ThinServer service, which may include system-level privileges. The primary impacts are integrity loss and availability loss: critical application, configuration, operating system, or ThinManager-related files may be removed, causing service failure, denial of service, or broader host instability.

Why it matters to the business

Exploitation can disrupt ThinManager/ThinServer availability and potentially interrupt operator workstations, thin-client management, or industrial operations that rely on ThinManager. Because exploitation is unauthenticated, remotely reachable, low-complexity, and assessed as weaponized with a high EPSS score, exposed systems should be treated as high-priority even though the vulnerability is not currently listed in CISA KEV. File deletion on an OT management server can lead to production downtime, delayed recovery, loss of configuration data, and increased incident response costs.

How an attack unfolds

An attacker first identifies a reachable ThinManager ThinServer instance, typically by scanning for exposed ThinManager services or synchronization protocol endpoints. The attacker then sends a specially crafted synchronization protocol message containing traversal sequences or otherwise malformed path data. Because the server does not sufficiently constrain the requested path to the intended synchronization directory, ThinServer processes the request against an attacker-selected file path. If the targeted file exists and the ThinServer service account has permission to remove it, the file is deleted with service privileges. The attacker can repeat this against configuration, application, or system files to degrade the ThinServer installation, prevent terminals from functioning correctly, or force a denial-of-service condition requiring restoration from backup or reinstallation.

How to fix it

Upgrade Rockwell Automation ThinManager/ThinServer to a vendor-supported release that contains the fix for this vulnerability. No exact fixed version was provided in the input, so administrators should consult the current Rockwell Automation advisory and apply the latest available ThinManager update for the deployed major version. If immediate patching is not possible, restrict ThinServer synchronization protocol access to trusted management hosts only, block exposure from enterprise, internet-facing, and untrusted network segments, enforce firewall allowlists, and place ThinManager systems in a tightly controlled OT management zone. Disable unused ThinManager services where operationally feasible. Ensure current offline backups exist for ThinManager configuration, application files, and the underlying Windows host so arbitrary file deletion can be recovered quickly. Avoid running the service with broader privileges than required, where supported by the vendor configuration.

How to confirm the fix worked

Confirm the installed ThinManager/ThinServer version against Rockwell Automation's fixed-version guidance and verify the patched build is running after upgrade. From network controls, validate that ThinServer synchronization services are reachable only from explicitly authorized management systems and not from user subnets, remote access networks, vendor networks, or the internet. Review firewall rules and perform controlled internal scanning to confirm that ThinManager service ports are not broadly exposed. On Windows hosts, verify that file deletion auditing or EDR telemetry can capture deletion activity initiated by the ThinServer process. After remediation, test normal terminal synchronization and ThinManager operations to confirm business functionality remains intact.

Typical attack path

1. Discover a Rockwell Automation ThinManager ThinServer service reachable from an untrusted network.
2. Confirm that the service is a vulnerable ThinServer instance or is running an unpatched ThinManager version.
3. Craft a synchronization protocol message containing path traversal input targeting files outside the expected synchronization directory.
4. Send the crafted message without authentication to the ThinServer service.
5. ThinServer processes the malformed path and deletes the attacker-selected file using the service account's privileges.
6. Repeat file deletion against files likely to disrupt ThinManager, Windows services, configuration, or application availability.
7. Use the resulting service failure or operational disruption to cause denial of service, force recovery activity, or support a broader intrusion campaign.

How to detect it

Look for evidence of abnormal file deletion or service disruption on ThinManager ThinServer hosts. Useful sources include Rockwell ThinManager/ThinServer application logs, Windows Event Logs, EDR file and process telemetry, Sysmon events, firewall logs, packet captures, and network IDS data for ThinManager service traffic. Prioritize events where the ThinServer process or service account deleted files outside expected ThinManager working directories, especially immediately before service crashes, failed startups, terminal connection failures, or configuration loss. In Windows Security logs, correlate object deletion events with the ThinServer service account and process context where available. In Sysmon or EDR, look for FileDelete/FileDeleteDetected events initiated by ThinServer executables. In network telemetry, inspect inbound synchronization protocol traffic for traversal sequences such as '../', '..\', encoded traversal variants, or repeated malformed messages followed by file deletion or service failure. Because this vulnerability causes destructive behavior rather than a stable implant, absence of a persistent artifact does not rule out exploitation; focus on timing correlation between suspicious network traffic and deleted files or ThinServer instability.

• ThinServer.exe deleting files outside the ThinManager installation or synchronization directories
• TManager.exe deleting files outside the ThinManager installation or synchronization directories
• Windows Security Event ID 4660 with ThinServer.exe as the deleting process
• Windows Security Event ID 4663 with DELETE access and ThinServer.exe as the process
• Sysmon Event ID 23 FileDelete where Image contains ThinServer.exe
• Sysmon Event ID 26 FileDeleteDetected where Image contains ThinServer.exe
• ../ in inbound ThinManager synchronization protocol traffic
• ..\ in inbound ThinManager synchronization protocol traffic
• %2e%2e%2f in inbound ThinManager synchronization protocol traffic
• %2e%2e%5c in inbound ThinManager synchronization protocol traffic
• ..%2f in inbound ThinManager synchronization protocol traffic
• ..%5c in inbound ThinManager synchronization protocol traffic
• ThinServer service crash shortly after inbound synchronization protocol traffic
• Unexpected deletion of ThinManager configuration files by the ThinServer service account

What your security team should do

• Treat affected ThinManager ThinServer systems as high priority because exploitation is unauthenticated, low-complexity, weaponized, and has a high EPSS score.
• Immediately inventory all Rockwell Automation ThinManager/ThinServer deployments and identify any systems reachable from untrusted networks.
• Patch to the latest Rockwell Automation fixed release as soon as operational change windows allow.
• Before patching, enforce network allowlisting so only approved ThinManager management or synchronization peers can reach ThinServer services.
• Search historical logs and EDR telemetry for suspicious file deletion activity initiated by ThinServer processes, especially near service crashes or unexpected ThinManager outages.
• Enable or confirm Windows file deletion auditing, Sysmon file deletion telemetry, and EDR process/file event collection on ThinManager servers.
• Review backups for ThinManager configuration and Windows system state; perform a restore test if these servers are operationally critical.
• Monitor for repeated malformed synchronization traffic, traversal strings, or unexplained ThinServer service instability.
• Coordinate remediation with OT operations teams to avoid unplanned disruption to thin-client or HMI availability.