SB2023063015 - Multiple vulnerabilities in Ovarro TBox RTUs
Published: June 30, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2023-36607)
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to missing authorization for some API commands. A remote attacker can gain access to sensitive information on the target system.
2) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2023-36609)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to inclusion of functionality from untrusted control sphere. A remote administrator can set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
3) Insufficient Entropy (CVE-ID: CVE-2023-36610)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected TBox RTUs generate software security tokens using insufficient entropy. A remote attacker can brute-force the token and authenticate themselves.
4) Improper Authorization (CVE-ID: CVE-2023-36611)
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to improper authorization. A remote user can establish an SSH session and and access files requiring higher privileges.
5) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2023-36608)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected TBox RTUs store hashed passwords using MD5 encryption. A remote user can gain access to sensitive information on the system.
6) Unprotected storage of credentials (CVE-ID: CVE-2023-3395)
The vulnerability allows a local user to gain access to other users' credentials.
The vulnerability exists due to application stored credentials in plain text in the TWinSoft Configuration Tool. A remote user can obtain the plaintext password.
Remediation
Install update from vendor's website.