Lucene search

IcscertCVE-2021-22646

HistoryJul 28, 2022 - 3:15 p.m.

CVE-2021-22646

2022-07-2815:15:07

icscert

web.nvd.nist.gov

cve-2021-22646

ipk package

twinsoft

ovarro tbox

malicious code execution

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

Affected configurations

Nvd

Node

ovarrotwinsoftRange<12.4

Node

ovarrotbox_lt2-530_firmwareRange<1.46

AND

ovarrotbox_lt2-530Match-

Node

ovarrotbox_lt2-532_firmwareRange<1.46

AND

ovarrotbox_lt2-532Match-

Node

ovarrotbox_lt2-540_firmwareRange<1.46

AND

ovarrotbox_lt2-540Match-

Node

ovarrotbox_ms-cpu32_firmwareRange<1.46

AND

ovarrotbox_ms-cpu32Match-

Node

ovarrotbox_ms-cpu32-s2_firmwareRange<1.46

AND

ovarrotbox_ms-cpu32-s2Match-

Node

ovarrotbox_rm2_firmwareRange<1.46

AND

ovarrotbox_rm2Match-

Node

ovarrotbox_tg2_firmwareRange<1.46

AND

ovarrotbox_tg2Match-

VendorProductVersionCPE
ovarrotwinsoft*cpe:2.3:a:ovarro:twinsoft:*:*:*:*:*:*:*:*
ovarrotbox_lt2-530_firmware*cpe:2.3:o:ovarro:tbox_lt2-530_firmware:*:*:*:*:*:*:*:*
ovarrotbox_lt2-530-cpe:2.3:h:ovarro:tbox_lt2-530:-:*:*:*:*:*:*:*
ovarrotbox_lt2-532_firmware*cpe:2.3:o:ovarro:tbox_lt2-532_firmware:*:*:*:*:*:*:*:*
ovarrotbox_lt2-532-cpe:2.3:h:ovarro:tbox_lt2-532:-:*:*:*:*:*:*:*
ovarrotbox_lt2-540_firmware*cpe:2.3:o:ovarro:tbox_lt2-540_firmware:*:*:*:*:*:*:*:*
ovarrotbox_lt2-540-cpe:2.3:h:ovarro:tbox_lt2-540:-:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32_firmware*cpe:2.3:o:ovarro:tbox_ms-cpu32_firmware:*:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32-cpe:2.3:h:ovarro:tbox_ms-cpu32:-:*:*:*:*:*:*:*
ovarrotbox_ms-cpu32-s2_firmware*cpe:2.3:o:ovarro:tbox_ms-cpu32-s2_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ovarro	twinsoft	*	cpe:2.3:a:ovarro:twinsoft::::::::
ovarro	tbox_lt2-530_firmware	*	cpe:2.3:o:ovarro:tbox_lt2-530_firmware::::::::
ovarro	tbox_lt2-530	-	cpe:2.3:h:ovarro:tbox_lt2-530:-:::::::*
ovarro	tbox_lt2-532_firmware	*	cpe:2.3:o:ovarro:tbox_lt2-532_firmware::::::::
ovarro	tbox_lt2-532	-	cpe:2.3:h:ovarro:tbox_lt2-532:-:::::::*
ovarro	tbox_lt2-540_firmware	*	cpe:2.3:o:ovarro:tbox_lt2-540_firmware::::::::
ovarro	tbox_lt2-540	-	cpe:2.3:h:ovarro:tbox_lt2-540:-:::::::*
ovarro	tbox_ms-cpu32_firmware	*	cpe:2.3:o:ovarro:tbox_ms-cpu32_firmware::::::::
ovarro	tbox_ms-cpu32	-	cpe:2.3:h:ovarro:tbox_ms-cpu32:-:::::::*
ovarro	tbox_ms-cpu32-s2_firmware	*	cpe:2.3:o:ovarro:tbox_ms-cpu32-s2_firmware::::::::

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "product": "TBox",
    "vendor": "Ovarro",
    "versions": [
      {
        "status": "affected",
        "version": "LT2"
      },
      {
        "status": "affected",
        "version": "MS-CPU32"
      },
      {
        "status": "affected",
        "version": "MS-CPU32-S2"
      },
      {
        "status": "affected",
        "version": "RM2"
      },
      {
        "status": "affected",
        "version": "TG2"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-21-054-04

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

Related for CVE-2021-22646