Vendor
Ovarro
12 known vulnerabilities.
Ovarro at a glance
- Last 12 months
- 0
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 7.2ICSA-23-180-03 6 CVEs
Ovarro TBox RTUs
Successful exploitation of these vulnerabilities could result in sensitive system information being exposed andprivilege escalation.
-
High max 8.8
Ovarro TBox (Update A)
Successful exploitation of these vulnerabilities could result in remote code execution, which may cause a denial-of-service condition.
first Feb 23, 2021
12 results · Feed
-
Medium 6.5
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with acc…
-
Medium 6.5
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could all…
-
Medium 5.9
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate …
-
High 7.2
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker cou…
-
Medium 6.5
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
-
Unscored —
CVE-2023-36607
The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.
-
High 8.8
Ovarro TBox Code Injection
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
-
High 7.5
Ovarro TBox Use of Hard-coded Cryptographic Key
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
-
High 8.8
Ovarro TBox Incorrect Permission Assignment for Critical Resource
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
-
High 7.5
Ovarro TBox Relative Path Traversal
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
-
High 7.5
Ovarro TBox Insufficiently Protected Credentials
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
-
High 7.5
Ovarro TBox Uncontrolled Resource Consumption
An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.