Code injection

An attacker may use TWinSoft and a malicious source project file TPG to extract files on machine executing Ovarro TWinSoft, which could lead to code execution...

CVE-2021-22646 Ovarro TBox Code Injection

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution...

CVE-2021-22646

CVE-2021-22646 is a code injection vulnerability in Ovarro TBox where the ipk package containing TWinSoft configurations can be uploaded, extracted, and executed on affected RTUs, enabling remote code execution. Affected products include TBoxLT2, TBox MS-CPU32, TBox MS-CPU32-S2, TBox RM2, and TBo...

CVE-2021-22644

CVE-2021-22644 is part of a set of vulnerabilities in Ovarro TBox/TWinSoft. The TWinSoft software uses a custom hardcoded user “TWinSoft” with a hardcoded key, enabling attackers to extract the hardcoded cryptographic key (CVE-2021-22644) and, with other flaws (CVE-2021-22646, CVE-2021-22648, CVE...

CVE-2021-22644 Ovarro TBox Use of Hard-coded Cryptographic Key

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key...

CVE-2021-22644 Ovarro TBox Use of Hard-coded Cryptographic Key

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key...

CVE-2021-22650 Ovarro TBox Relative Path Traversal

An attacker may use TWinSoft and a malicious source project file TPG to extract files on machine executing Ovarro TWinSoft, which could lead to code execution...

CVE-2021-22650

CVE-2021-22650 concerns a path traversal vulnerability in Ovarro TWinSoft. An attacker may use a malicious source project file (TPG) with TWinSoft to extract files on the machine running TWinSoft, potentially enabling code execution. Affected guidance from connected sources notes remediation by u...

PT-2022-9259 · Ovarro · Ovarro Tbox Twinsoft

Name of the Vulnerable Software and Affected Versions: Ovarro TBox TWinSoft affected versions not specified Description: The issue concerns the use of a custom hardcoded user TWinSoft with a hardcoded key in Ovarro TBox TWinSoft. Recommendations: At the moment, there is no information about a new...

CVE-2021-22644: Use of Hard-coded Credentials

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key...

CVE-2021-22646: Improper Control of Generation of Code

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution...

CVE-2021-22650: Improper Limitation of a Pathname to a Restricted Directory

An attacker may use TWinSoft and a malicious source project file TPG to extract files on machine executing Ovarro TWinSoft, which could lead to code execution...

PT-2022-9262 · Ovarro · Ovarro Twinsoft

Name of the Vulnerable Software and Affected Versions: Ovarro TWinSoft affected versions not specified Description: An attacker may use TWinSoft and a malicious source project file TPG to extract files on the machine executing Ovarro TWinSoft, which could lead to code execution. Recommendations: ...

Ovarro TWinSoft 安全漏洞

Ovarro TWinSoft is an application platform from Ovarro Germany. One that can be used anywhere, anytime to access network functions using its mobile devices and PCs. Ovarro TWinSoft suffers from a security vulnerability that stems from TBox's proprietary Modbus file access feature that allows an...

Ovarro TWinSoft 代码注入漏洞

Ovarro TWinSoft is an application platform from Ovarro Germany. One that can be used anywhere, anytime to access web features using its mobile devices and PCs. A code injection vulnerability exists in several Ovarro TWinSoft products, which stems from the fact that ipk packages containing...

Ovarro TWinSoft 信任管理问题漏洞

Ovarro TWinSoft is an application platform from Ovarro Germany. One that can be used anytime, anywhere to access web features using its mobile devices and PCs. A security vulnerability exists in Ovarro TWinSoft that stems from TWinSoft's use of a custom hardcoded user TWinSoft with a hardcoded ke...