CVE-2023-2443 - Vulnerability Details - OpenCVE

Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rockwellautomation	Thinmanager

Configuration 1 [-]

cpe:2.3:a:rockwellautomation:thinmanager:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-33928	Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.

Fixes

Solution

Customers should upgrade to 13.0.2 to correct this issue. If upgrading is not possible, customers should ensure that the 3DES encryption algorithm is not used.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442

History

Fri, 24 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Rockwell

Published: 2023-05-11T18:08:08.060Z

Updated: 2025-01-24T21:16:26.466Z

Reserved: 2023-05-01T13:52:27.487Z

Link: CVE-2023-2443

Vulnrichment

Updated: 2024-08-02T06:26:09.005Z

NVD

Status : Modified

Published: 2023-05-11T19:15:09.377

Modified: 2024-11-21T07:58:37.627

Link: CVE-2023-2443

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2443", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2023-05-01T13:52:27.487Z", "datePublished": "2023-05-11T18:08:08.060Z", "dateUpdated": "2025-01-24T21:16:26.466Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ThinManager ", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "<=13.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Rockwell Automation ThinManager product allows the use of medium strength ciphers.  If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.</span>\n\n"}], "value": "\nRockwell Automation ThinManager product allows the use of medium strength ciphers. \u00a0If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.\n\n"}], "impacts": [{"capecId": "CAPEC-20", "descriptions": [{"lang": "en", "value": "CAPEC-20 Encryption Brute Forcing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Rockwell Automation ThinManager Software Utilizes Inadequate Encryption Strength", "lang": "en"}]}], "providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2023-05-11T18:08:08.060Z"}, "references": [{"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Customers should upgrade to 13.0.2 to correct this issue.  If upgrading is not possible, customers should ensure that the <span style=\"background-color: rgb(255, 255, 255);\">3DES encryption algorithm is not used.</span>"}], "value": "Customers should upgrade to 13.0.2 to correct this issue.\u00a0 If upgrading is not possible, customers should ensure that the\u00a03DES encryption algorithm is not used."}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:26:09.005Z"}, "title": "CVE Program Container", "references": [{"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-24T21:16:14.230416Z", "id": "CVE-2023-2443", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T21:16:26.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:26:09.005Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2443", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-24T21:16:14.230416Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T21:16:09.851Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-20", "descriptions": [{"lang": "en", "value": "CAPEC-20 Encryption Brute Forcing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "ThinManager ", "versions": [{"status": "affected", "version": "<=13.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Customers should upgrade to 13.0.2 to correct this issue.\u00a0 If upgrading is not possible, customers should ensure that the\u00a03DES encryption algorithm is not used.", "supportingMedia": [{"type": "text/html", "value": "Customers should upgrade to 13.0.2 to correct this issue.  If upgrading is not possible, customers should ensure that the <span style=\"background-color: rgb(255, 255, 255);\">3DES encryption algorithm is not used.</span>", "base64": false}]}], "references": [{"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nRockwell Automation ThinManager product allows the use of medium strength ciphers. \u00a0If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Rockwell Automation ThinManager product allows the use of medium strength ciphers.  If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Rockwell Automation ThinManager Software Utilizes Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2023-05-11T18:08:08.060Z"}}}, "cveMetadata": {"cveId": "CVE-2023-2443", "state": "PUBLISHED", "dateUpdated": "2025-01-24T21:16:26.466Z", "dateReserved": "2023-05-01T13:52:27.487Z", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "datePublished": "2023-05-11T18:08:08.060Z", "assignerShortName": "Rockwell"}, "dataVersion": "5.1"}