CVE-2023-36608

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

Ovarro TBox RTUs 安全特征问题漏洞

Ovarro TBox RTUs is a modular remote monitoring and automation solution from Ovarro Germany. The Ovarro TBox RTUs suffers from a security signature issue vulnerability that arises from the use of insufficient entropy to generate software security tokens, where the random seed used to generate the...

Ovarro TBox RTUs 授权问题漏洞

Ovarro TBox RTUs is a modular remote monitoring and automation solution from Ovarro Germany. An authorization issue vulnerability exists in Ovarro TBox RTUs that stems from allowing a low-privileged user to access higher-privileged software security tokens, potentially allowing an attacker to...

CVE-2023-36609: Inclusion of Functionality from Untrusted Control Sphere

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges...

PT-2023-25630 · Tbox Rtus +1 · Tbox Rtus +1

Name of the Vulnerable Software and Affected Versions: TBox RTUs affected versions not specified Description: The issue concerns TBox RTUs that run OpenVPN with root privileges and are capable of executing user-defined configuration scripts. An attacker can set up a local OpenVPN server and push ...

CVE-2023-36610: Insufficient Entropy

​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successful...

CVE-2023-36608: Use of a Broken or Risky Cryptographic Algorithm

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

PT-2023-25632 · Tbox Rtus · Tbox Rtus

Name of the Vulnerable Software and Affected Versions: TBox RTUs affected versions not specified Description: The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of...

Ovarro TBox RTUs 安全漏洞

Ovarro TBox RTUs is a modular remote monitoring and automation solution from Ovarro Germany. The Ovarro TBox RTUs suffers from a security vulnerability that originates from running OpenVPN with root privileges and the ability to run user-defined configuration scripts, which allows an attacker to...

CVE-2023-36611: Improper Authorization

The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens...

Authorization

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents...

CVE-2023-36607 CVE-2023-36607

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents...

Ovarro TBox RTUs

1. EXECUTIVE SUMMARY ​CVSS v3 7.2 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Ovarro ​Equipment: TBox RTUs ​Vulnerabilities: Missing Authorization, Use of Broken or Risky Cryptographic Algorithm, Inclusion of Functionality from Untrusted Control Sphere, Insufficient Entropy,...

PT-2023-25628 · Tbox Rtus · Tbox Rtus

Name of the Vulnerable Software and Affected Versions: TBox RTUs affected versions not specified Description: The issue concerns missing authorization for running certain API commands, which could allow an attacker to reveal sensitive information, including software versions and web server file...

CVE-2023-36607: Missing Authorization

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents...

Flaws in Ovarro TBox RTUs Could Open Industrial Systems to Remote Attacks

As many as five vulnerabilities have been uncovered in Ovarro's TBox remote terminal units RTUs that, if left unpatched, could open the door for escalating attacks against critical infrastructures, like remote code execution and denial-of-service. "Successful exploitation of these vulnerabilities...

SCADA Trojans: Attacking the Grid + Advantech vulnerabilities

Hi! You can download the slides of the research I was presenting at RootedCon'11 in Madrid "SCADA Trojans: Attacking the grid". A journey into attacking the power grid. I presented: - 0days in Advantech/BroadWin WebAccess SCADA product - Weak Design/Vulnerabilities in CSE-Semaphore TBOX RTUs -...