CVE-2021-22642

An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.

CVE-2023-36609

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.