Vendors / Ovarro Records 12 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 2
Exploited now Ovarro records in CISA KEV No Ovarro vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01376 · Published 2022-07-28 · No fix listed CWE-23
Priority MEDIUM 50
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00832 · Published 2022-07-28 · No fix listed CWE-321
Priority MEDIUM 50
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00832 · Published 2022-07-28 · No fix listed CWE-522
Priority MEDIUM 46
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01437 · Published 2022-07-28 · No fix listed CWE-94
Priority MEDIUM 45
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00917 · Published 2022-07-28 · No fix listed CWE-732
Priority MEDIUM 40
An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00876 · Published 2022-07-28 · No fix listed CWE-400
Open these records in search → All records by CVSS severity
5 2 5 0 0
THREATIST.IORead the docs