high8.8
CVE-2021-22646
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
Impact
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ovarro | Twinsoft | before 12.4 |
| Ovarro | Tbox Lt2-530 Firmware | before 1.46 |
| Ovarro | Tbox Lt2-532 Firmware | before 1.46 |
| Ovarro | Tbox Lt2-540 Firmware | before 1.46 |
| Ovarro | Tbox Ms-Cpu32 Firmware | before 1.46 |
| Ovarro | Tbox Ms-Cpu32-S2 Firmware | before 1.46 |
| Ovarro | Tbox Rm2 Firmware | before 1.46 |
| Ovarro | Tbox Tg2 Firmware | before 1.46 |