Lucene search

[email protected]CVE-2023-36607

HistoryJun 29, 2023 - 9:15 p.m.

CVE-2023-36607

2023-06-2921:15:09

CWE-862

[email protected]

web.nvd.nist.gov

tbox

rtus

authorization

api

commands

security vulnerability

information disclosure

cve-2023-36607

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

JSON

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.

Affected configurations

NVD

Node

ovarrotbox_ms-cpu32_firmwareRange≤1.50.598

AND

ovarrotbox_ms-cpu32Match-

Node

ovarrotbox_ms-cpu32-s2_firmwareRange≤1.50.598

AND

ovarrotbox_ms-cpu32-s2Match-

Node

ovarrotbox_lt2_firmwareRange≤1.50.598

AND

ovarrotbox_lt2Match-

Node

ovarrotbox_tg2_firmwareRange≤1.50.598

AND

ovarrotbox_tg2Match-

Node

ovarrotbox_rm2_firmwareRange≤1.50.598

AND

ovarrotbox_rm2Match-

CPENameOperatorVersion
ovarro:tbox_ms-cpu32_firmwareovarro tbox ms-cpu32 firmwarele1.50.598

CPE	Name	Operator	Version
ovarro:tbox_ms-cpu32_firmware	ovarro tbox ms-cpu32 firmware	le	1.50.598

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "TBox RM2",
    "vendor": "Ovarro",
    "versions": [
      {
        "lessThanOrEqual": "1.50.598",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TBox TG2",
    "vendor": "Ovarro",
    "versions": [
      {
        "lessThanOrEqual": "1.50.598",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TBox LT2",
    "vendor": "Ovarro",
    "versions": [
      {
        "lessThanOrEqual": "1.50.598",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TBox MS-CPU32-S2",
    "vendor": "Ovarro",
    "versions": [
      {
        "lessThanOrEqual": "1.50.598",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TBox MS-CPU32",
    "vendor": "Ovarro",
    "versions": [
      {
        "lessThanOrEqual": "1.50.598",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-180-03

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

JSON

Related for CVE-2023-36607

cvelist1 prion1 nvd1 ics1