High ICSA-23-180-03 6 CVEs

Ovarro TBox RTUs

Published Jun 29, 2023 · Updated Jun 29, 2023

Vendor: Ovarro Product: TBox LT2 Product: TBox MS-CPU32 Product: TBox MS-CPU32-S2 Product: TBox RM2 Product: TBox TG2

Summary

Successful exploitation of these vulnerabilities could result in sensitive system information being exposed andprivilege escalation.

Vulnerabilities 6

High 7.2

CVE-2023-36609

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker cou…

Ovarro TBox MS-CPU32-S2 TBox TG2 TBox MS-CPU32

Jul 3, 2023
Medium 6.5

CVE-2023-3395

All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with acc…

Ovarro TBox MS-CPU32-S2 TBox TG2 TBox MS-CPU32

Jul 3, 2023
Medium 6.5

CVE-2023-36608

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.

Ovarro TBox MS-CPU32 TBox LT2 TBox RM2

Jul 3, 2023
Medium 6.5

CVE-2023-36611

The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could all…

Ovarro TBox MS-CPU32 TBox LT2 TBox RM2

Jul 3, 2023
Medium 5.9

CVE-2023-36610

The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate …

Ovarro TBox MS-CPU32-S2 TBox TG2 TBox MS-CPU32

Jul 3, 2023
Unscored —

CVE-2023-36607

CVE-2023-36607

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.

Ovarro TBox RM2 TBox MS-CPU32-S2 TBox TG2

Jun 29, 2023

Revision history

2023-06-29 #1
Initial Publication

References

ICSA Advisory ICSA-23-180-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B