Skip to main content

Tbox Ms Cpu32 Firmware CVE-2023-36609

HIGH
Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
2023-07-03 ics-cert@hq.dhs.gov
Information Disclosure Tbox Ms Cpu32 Firmware Tbox Ms Cpu32 S2 Firmware Tbox Lt2 Firmware Tbox Tg2 Firmware Tbox Rm2 Firmware
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 03, 2023 - 20:15 nvd
HIGH 7.2

DescriptionNVD

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

AnalysisAI

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-829. The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges. Affected products include: Ovarro Tbox Ms-Cpu32 Firmware, Ovarro Tbox Ms-Cpu32-S2 Firmware, Ovarro Tbox Lt2 Firmware, Ovarro Tbox Tg2 Firmware, Ovarro Tbox Rm2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Tbox Ms Cpu32 Firmware

View all
CVE-2023-3395 MEDIUM
6.5 Jul 03

​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. Rated medium severity
CVE-2023-36611 MEDIUM
6.5 Jul 03

The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. Rated medium se
CVE-2023-36608 MEDIUM
6.5 Jul 03

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. Rated med
CVE-2023-36610 MEDIUM
5.9 Jul 03

​The affected TBox RTUs generate software security tokens using insufficient entropy. Rated medium severity (CVSS 5.9),

CVE-2023-36607 MEDIUM
5.3 Jun 29

The affected TBox RTUs are missing authorization for running some API commands. Rated medium severity (CVSS 5.3), this v

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all
CVE-2025-32463 CRITICAL POC
9.3
CVE-2026-0770 CRITICAL POC
9.8
CVE-2025-27607 HIGH POC
8.8
CVE-2026-1699 CRITICAL POC
10.0
CVE-2026-27941 CRITICAL POC
9.9
CVE-2020-8128 CRITICAL POC
9.8
CVE-2019-13589 CRITICAL POC
9.8
CVE-2018-15486 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-36609 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy