Ovarro Tbox Lt2 Firmware
6 CVEs affecting Ovarro Tbox Lt2 Firmware. Latest disclosed: 2023-07-03. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36609 | High | 7.2 | 2023-07-03 | The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and pu… |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-36611 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges t… |
CVE-2023-36608 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. |
CVE-2023-36610 | Medium | 5.9 | 2023-07-03 | The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized… |
CVE-2023-36607 | Medium | 5.3 | 2023-06-29 | The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as s… |