CVE-2023-0027CWE-200

Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive Information

Medium · published March 17, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unauthorized user could read the connected device’s Modbus TCP Server AOI information.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00849 · 57.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-03-17T16:52Z
EPSS history
Timeline
  • 17 MAR 16:52Z
    Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive Information
    cvelistv5