by Kastro
Paper/Archive/CVE-2021-22646

CVE-2021-22646

Ovarro TBox — Ovarro TBox Code Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.1.731 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

Affected

ProductAffectedFixed inSource
TBoxLT2–CNA
TBoxMS-CPU32–CNA
TBoxMS-CPU32-S2–CNA
TBoxRM2–CNA
TBoxTG2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-054-04