medium6.5
CVE-2023-3395
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory.
Impact
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ovarro | Tbox Ms-Cpu32 Firmware | All versions |
| Ovarro | Tbox Ms-Cpu32-S2 Firmware | All versions |
| Ovarro | Tbox Lt2 Firmware | All versions |
| Ovarro | Tbox Tg2 Firmware | All versions |
| Ovarro | Tbox Rm2 Firmware | All versions |