CVE-2023-36609

Summary

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Affected Software

VendorProductVersion RangeStatus
OvarroTBox MS-CPU320 <= 1.50.598affected
Ovarro​TBox MS-CPU32-S20 <= 1.50.598affected
OvarroTBox LT20 <= 1.50.598affected
OvarroTBox TG20 <= 1.50.598affected
OvarroTBox RM20 <= 1.50.598affected

Weaknesses

  • CWE-829: CWE-829 Inclusion of Functionality from Untrusted Control Sphere

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References