Vulnerability · Published Jun 29, 2023 · Assigned by icscert
CVE-2023-36607CVE-2023-36607
Medium 5.3
In plain English
A medium-severity missing authorization in TBox LT2 from Ovarro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ovarro | TBox RM2 | 0 – through 1.50.598 |
| Ovarro | TBox TG2 | 0 – through 1.50.598 |
| Ovarro | TBox LT2 | 0 – through 1.50.598 |
| Ovarro | TBox MS-CPU32-S2 | 0 – through 1.50.598 |
| Ovarro | TBox MS-CPU32 | 0 – through 1.50.598 |
Weakness: CWE-862
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03 government-resource