Skip to main content

Tbox Ms Cpu32 Firmware CVE-2023-36610

MEDIUM
Insufficient Entropy (CWE-331)
2023-07-03 ics-cert@hq.dhs.gov
Information Disclosure Tbox Ms Cpu32 Firmware Tbox Ms Cpu32 S2 Firmware Tbox Lt2 Firmware Tbox Tg2 Firmware Tbox Rm2 Firmware
5.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 03, 2023 - 21:15 nvd
MEDIUM 5.9

DescriptionNVD

​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.

AnalysisAI

​The affected TBox RTUs generate software security tokens using insufficient entropy. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-331. ​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves. Affected products include: Ovarro Tbox Ms-Cpu32 Firmware, Ovarro Tbox Ms-Cpu32-S2 Firmware, Ovarro Tbox Lt2 Firmware, Ovarro Tbox Tg2 Firmware, Ovarro Tbox Rm2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Tbox Ms Cpu32 Firmware

View all
CVE-2023-36609 HIGH
7.2 Jul 03

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. Rated high sever
CVE-2023-3395 MEDIUM
6.5 Jul 03

​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. Rated medium severity
CVE-2023-36611 MEDIUM
6.5 Jul 03

The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. Rated medium se
CVE-2023-36608 MEDIUM
6.5 Jul 03

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. Rated med
CVE-2023-36607 MEDIUM
5.3 Jun 29

The affected TBox RTUs are missing authorization for running some API commands. Rated medium severity (CVSS 5.3), this v

Same weakness CWE-331 – Insufficient Entropy

View all
CVE-2025-47781 CRITICAL POC
9.8
CVE-2020-36925 CRITICAL POC
9.8
CVE-2023-49599 CRITICAL POC
9.8
CVE-2024-36400 CRITICAL POC
9.8
CVE-2022-34294 CRITICAL POC
9.8
CVE-2020-12735 CRITICAL POC
9.8
CVE-2026-22698 HIGH POC
7.5
CVE-2020-28924 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-36610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy