Lucene search

[email protected]NVD:CVE-2023-36609

HistoryJul 03, 2023 - 8:15 p.m.

CVE-2023-36609

2023-07-0320:15:09

CWE-829

[email protected]

web.nvd.nist.gov

cve-2023-36609

openvpn

tbox rtus

root privileges

configuration scripts

local server

malicious script

security vulnerability

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

28.4%

JSON

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Affected configurations

Nvd

Node

ovarrotbox_ms-cpu32_firmwareRange≤1.50.598

AND

ovarrotbox_ms-cpu32Match-

Node

ovarrotbox_ms-cpu32-s2_firmwareRange≤1.50.598

AND

ovarrotbox_ms-cpu32-s2Match-

Node

ovarrotbox_lt2_firmwareRange≤1.50.598

AND

ovarrotbox_lt2Match-

Node

ovarrotbox_tg2_firmwareRange≤1.50.598

AND

ovarrotbox_tg2Match-

Node

ovarrotbox_rm2_firmwareRange≤1.50.598

AND

ovarrotbox_rm2Match-

VendorProductVersionCPE
ovarrotbox_ms-cpu32_firmware*cpe:2.3:o:ovarro:tbox_ms-cpu32_firmware:*:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32-cpe:2.3:h:ovarro:tbox_ms-cpu32:-:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32-s2_firmware*cpe:2.3:o:ovarro:tbox_ms-cpu32-s2_firmware:*:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32-s2-cpe:2.3:h:ovarro:tbox_ms-cpu32-s2:-:*:*:*:*:*:*:*
ovarrotbox_lt2_firmware*cpe:2.3:o:ovarro:tbox_lt2_firmware:*:*:*:*:*:*:*:*
ovarrotbox_lt2-cpe:2.3:h:ovarro:tbox_lt2:-:*:*:*:*:*:*:*
ovarrotbox_tg2_firmware*cpe:2.3:o:ovarro:tbox_tg2_firmware:*:*:*:*:*:*:*:*
ovarrotbox_tg2-cpe:2.3:h:ovarro:tbox_tg2:-:*:*:*:*:*:*:*
ovarrotbox_rm2_firmware*cpe:2.3:o:ovarro:tbox_rm2_firmware:*:*:*:*:*:*:*:*
ovarrotbox_rm2-cpe:2.3:h:ovarro:tbox_rm2:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ovarro	tbox_ms-cpu32_firmware	*	cpe:2.3:o:ovarro:tbox_ms-cpu32_firmware::::::::
ovarro	tbox_ms-cpu32	-	cpe:2.3:h:ovarro:tbox_ms-cpu32:-:::::::*
ovarro	tbox_ms-cpu32-s2_firmware	*	cpe:2.3:o:ovarro:tbox_ms-cpu32-s2_firmware::::::::
ovarro	tbox_ms-cpu32-s2	-	cpe:2.3:h:ovarro:tbox_ms-cpu32-s2:-:::::::*
ovarro	tbox_lt2_firmware	*	cpe:2.3:o:ovarro:tbox_lt2_firmware::::::::
ovarro	tbox_lt2	-	cpe:2.3:h:ovarro:tbox_lt2:-:::::::*
ovarro	tbox_tg2_firmware	*	cpe:2.3:o:ovarro:tbox_tg2_firmware::::::::
ovarro	tbox_tg2	-	cpe:2.3:h:ovarro:tbox_tg2:-:::::::*
ovarro	tbox_rm2_firmware	*	cpe:2.3:o:ovarro:tbox_rm2_firmware::::::::
ovarro	tbox_rm2	-	cpe:2.3:h:ovarro:tbox_rm2:-:::::::*