CVE-2021-22646 Ovarro TBox Code Injection

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution...

CVE-2021-22644 Ovarro TBox Use of Hard-coded Cryptographic Key

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key...

CVE-2021-22644 Ovarro TBox Use of Hard-coded Cryptographic Key

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key...

CVE-2021-22644

CVE-2021-22644 is part of a set of vulnerabilities in Ovarro TBox/TWinSoft. The TWinSoft software uses a custom hardcoded user “TWinSoft” with a hardcoded key, enabling attackers to extract the hardcoded cryptographic key (CVE-2021-22644) and, with other flaws (CVE-2021-22646, CVE-2021-22648, CVE...

CVE-2021-22648 Ovarro TBox Incorrect Permission Assignment for Critical Resource

Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file...

CVE-2021-22648 Ovarro TBox Incorrect Permission Assignment for Critical Resource

Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file...

CVE-2021-22648

CVE-2021-22648 affects Ovarro’s TBox RTU line (LT2, MS-CPU32, MS-CPU32-S2, RM2, TG2) and TWinSoft prior to 12.4, plus firmware before 1.46. The issue is Incorrect Permission Assignment for Critical Resource via TBox’s proprietary Modbus file access, allowing an attacker to read, alter, or delete ...

CVE-2021-22650 Ovarro TBox Relative Path Traversal

An attacker may use TWinSoft and a malicious source project file TPG to extract files on machine executing Ovarro TWinSoft, which could lead to code execution...

CVE-2021-22650 Ovarro TBox Relative Path Traversal

An attacker may use TWinSoft and a malicious source project file TPG to extract files on machine executing Ovarro TWinSoft, which could lead to code execution...

CVE-2021-22640 Ovarro TBox Insufficiently Protected Credentials

An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks...

CVE-2021-22640

CVE-2021-22640 affects Ovarro TBox RTUs (LT2, MS-CPU32, MS-CPU32-S2, RM2, TG2) and pre-12.4/TWinSoft firmware ≤ 1.46. It discloses credentials: login passwords can be decrypted via network traffic capture and brute force attempts. ICS Advisory ICSA-21-054-04 confirms remote/exploit potential and ...

CVE-2021-22640 Ovarro TBox Insufficiently Protected Credentials

An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks...

CVE-2021-22642 Ovarro TBox Uncontrolled Resource Consumption

An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system...

CVE-2021-22642

CVE-2021-22642 corresponds to an Ovarro TBox vulnerability in which a remote attacker can crash the device by sending specially crafted invalid Modbus frames. The issue affects multiple TBox RTU products (e.g., TBox LT2, TBox MS-CPU32, MS-CPU32-S2, RM2, TG2) and is described under ICSA-21-054-04 ...

CVE-2021-22642 Ovarro TBox Uncontrolled Resource Consumption

An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system...

PT-2022-9261 · Ovarro · Ovarro Tbox

Name of the Vulnerable Software and Affected Versions: Ovarro TBox affected versions not specified Description: The issue allows attackers to read, alter, or delete the configuration file through Ovarro TBox proprietary Modbus file access functions. Recommendations: At the moment, there is no...

PT-2022-9260 · Ovarro · Ovarro Tbox

Name of the Vulnerable Software and Affected Versions: Ovarro TBox affected versions not specified Description: The issue allows malicious code execution by uploading, extracting, and executing the "ipk" package containing the configuration created by TWinSoft in Ovarro TBox. Recommendations: At...

PT-2022-9258 · Ovarro · Ovarro Tbox

Name of the Vulnerable Software and Affected Versions: Ovarro TBox affected versions not specified Description: An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system. Recommendations: At the moment, there is no information about a newer version that contain...

PT-2022-9259 · Ovarro · Ovarro Tbox Twinsoft

Name of the Vulnerable Software and Affected Versions: Ovarro TBox TWinSoft affected versions not specified Description: The issue concerns the use of a custom hardcoded user TWinSoft with a hardcoded key in Ovarro TBox TWinSoft. Recommendations: At the moment, there is no information about a new...

PT-2022-9257 · Ovarro · Ovarro Tbox

Name of the Vulnerable Software and Affected Versions: Ovarro TBox affected versions not specified Description: An attacker can decrypt the Ovarro TBox login password by capturing communication and using brute force attacks. Recommendations: At the moment, there is no information about a newer...