Skip to content
OpenAdvisories
High · 7.2 CVE-2023-36609 EUVD-2023-40554GHSA-7cxv-6x8v-9gmq

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local Op…

Published Jul 3, 2023 · Updated Nov 25, 2024 · Assigned by icscert

Vendor: Ovarro Product: TBox LT2 Product: TBox MS-CPU32 Product: ​TBox MS-CPU32-S2 Product: TBox RM2 Product: TBox TG2

Description

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Affected products

VendorProductAffectedFixed
Ovarro TBox MS-CPU32 ≤ 1.50.598 —
Ovarro ​TBox MS-CPU32-S2 ≤ 1.50.598 —
Ovarro TBox LT2 ≤ 1.50.598 —
Ovarro TBox TG2 ≤ 1.50.598 —
Ovarro TBox RM2 ≤ 1.50.598 —

Advisories 1

References