description:
Rockwell Automation ThinManager product allows the use of medium strength ciphers.  If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.
problem types: Rockwell Automation ThinManager Software Utilizes Inadequate Encryption Strength
affected:
{
defaultStatus: unaffected
product: ThinManager
vendor: Rockwell Automation
versions:
status: affected, version: <=13.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Customers should upgrade to 13.0.2 to correct this issue.  If upgrading is not possible, customers should ensure that the 3DES encryption algorithm is not used.