CVE-2023-36609

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
Ovarro	TBox MS-CPU32	<= 1.50.598
Ovarro	TBox MS-CPU32-S2	<= 1.50.598
Ovarro	TBox LT2	<= 1.50.598
Ovarro	TBox TG2	<= 1.50.598
Ovarro	TBox RM2	<= 1.50.598
ovarro	tbox_ms-cpu32	<= 1.50.598
ovarro	tbox_ms-cpu32-s2	<= 1.50.598
ovarro	tbox_tg2	<= 1.50.598
ovarro	tbox_lt2	<= 1.50.598
ovarro	tbox_rm2	<= 1.50.598

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jul 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-36619.8A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown p CVE-2023-366105.9The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens i CVE-2023-366116.5The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “CVE-2023-366127.5Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write ar CVE-2023-366175.3A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characte CVE-2023-366188.8Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authentic CVE-2023-366199.8Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.CVE-2023-36627.3In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the curren CVE-2023-366204.6An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="CVE-2023-366219.1An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all r CVE-2023-366227.2The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject CVE-2023-366237.8The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a lo