Vendors / Ovarro Records 12 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 2
Exploited now Ovarro records in CISA KEV No Ovarro vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01376 · Published 2022-07-28 · No fix listed CWE-23
Priority MEDIUM 50
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00832 · Published 2022-07-28 · No fix listed CWE-321
Priority MEDIUM 50
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00832 · Published 2022-07-28 · No fix listed CWE-522
Priority MEDIUM 46
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01437 · Published 2022-07-28 · No fix listed CWE-94
Priority MEDIUM 45
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00917 · Published 2022-07-28 · No fix listed CWE-732
Priority MEDIUM 40
An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00876 · Published 2022-07-28 · No fix listed CWE-400
Priority LOW 35
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00698 · Published 2023-07-03 · No fix listed CWE-829
Priority LOW 31
The affected TBox RTUs are missing authorization for running some API commands.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00492 · Published 2023-06-29 · No fix listed CWE-862
Priority LOW 29
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00509 · Published 2023-07-03 · No fix listed CWE-285
Priority LOW 29
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00321 · Published 2023-07-03 · No fix listed CWE-256
Priority LOW 28
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0023 · Published 2023-07-03 · No fix listed CWE-327
Priority LOW 27
The affected TBox RTUs generate software security tokens using insufficient entropy.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00511 · Published 2023-07-03 · No fix listed CWE-331
Open these records in search → All records by CVSS severity
5 2 5 0 0
THREATIST.IORead the docs