Ovarro Tbox Tg2
12 CVEs affecting Ovarro Tbox Tg2. Latest disclosed: 2023-07-03. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22648 | High | 8.8 | 2022-07-28 | Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file. |
CVE-2021-22646 | High | 8.8 | 2022-07-28 | The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution. |
CVE-2021-22650 | High | 7.5 | 2022-07-28 | An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code executio… |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2021-22642 | High | 7.5 | 2022-07-28 | An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system. |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2023-36609 | High | 7.2 | 2023-07-03 | The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and pu… |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-36611 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges t… |
CVE-2023-36608 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. |
CVE-2023-36610 | Medium | 5.9 | 2023-07-03 | The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized… |
CVE-2023-36607 | Medium | 5.3 | 2023-06-29 | The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as s… |