high7.2
CVE-2023-36609
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts.
Impact
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ovarro | Tbox Ms-Cpu32 Firmware | through 1.50.598 |
| Ovarro | Tbox Ms-Cpu32-S2 Firmware | through 1.50.598 |
| Ovarro | Tbox Lt2 Firmware | through 1.50.598 |
| Ovarro | Tbox Tg2 Firmware | through 1.50.598 |
| Ovarro | Tbox Rm2 Firmware | through 1.50.598 |