CVE-2023-36607

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Ovarro	TBox RM2	<= 1.50.598
Ovarro	TBox TG2	<= 1.50.598
Ovarro	TBox LT2	<= 1.50.598
Ovarro	TBox MS-CPU32-S2	<= 1.50.598
Ovarro	TBox MS-CPU32	<= 1.50.598
ovarro	tbox_rm2	<= 1.50.598
ovarro	tbox_tg2	<= 1.50.598
ovarro	tbox_lt2	<= 1.50.598
ovarro	tbox_ms-cpu32-s2	<= 1.50.598
ovarro	tbox_ms-cpu32	<= 1.50.598

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jun 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-366086.5The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.CVE-2023-366097.2The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local Ope CVE-2023-36619.8A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown p CVE-2023-366105.9The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens i CVE-2023-366116.5The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “CVE-2023-366127.5Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write ar CVE-2023-366175.3A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characte CVE-2023-366188.8Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authentic CVE-2023-366199.8Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.CVE-2023-36627.3In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the curren CVE-2023-366204.6An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="CVE-2023-366219.1An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all r