CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
42.8%
Successful exploitation of these vulnerabilities could result in sensitive system information being exposed and privilege escalation.
The following firmware versions of TBox RTUs are affected:
3.2.1 MISSING AUTHORIZATION CWE-862
The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.
CVE-2023-36607 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
3.2.2 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
CVE-2023-36608 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
3.2.3 INCLUSION OF FUNCTIONALITY FROM UNTRUSTED CONTROL SPHERE CWE-829
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
CVE-2023-36609 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
3.2.4 INSUFFICIENT ENTROPY CWE-331
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.
CVE-2023-36610 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
3.2.5 IMPROPER AUTHORIZATION CWE-285
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens.
CVE-2023-36611 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
3.2.6 PLAINTEXT STORAGE OF A PASSWORD CWE-256
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.
CVE-2023-3395 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Floris Hendriks and Jeroen Wijenbergh of Radboud University reported these vulnerabilities to CISA.
Ovarro recommends users update the affected products to the latest version by downloading the newest software version from the Ovarro website in the “Customer Support” section.
In addition to applying patches, Ovarro has identified the following workarounds:
CVE-2023-36607: Disable SSH access through the integrated firewall and disable the user account SSH access by emptying its password in the application.
CVE-2023-36608: Update to TWinSoft version 12.7.2 or later, which includes firmware version 1.50.598.
CVE-2023-36609: Update to TWinSoft version 12.7.2 or later, which includes firmware version 1.50.598.
CVE-2023-36610: Disable SSH access through the integrated firewall and disable the user account SSH access by emptying its password in the application. Setting a password on the application will also cause the retrieved application to be encrypted.
CVE-2023-36611: Disable SSH access through the integrated firewall and disable the user account SSH access by emptying its password in the application. Setting a password on the application will also cause the retrieved application to be encrypted.
CVE-2023-3395: Use password protected files within the TBox software. This will prevent attackers from opening files to load passwords into memory in plaintext.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability these vulnerabilities. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3395
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36607
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36608
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36609
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36610
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36611
www.ovarro.com/
cisa.gov/ics
cisa.gov/ics
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03
cwe.mitre.org/data/definitions/256.html
cwe.mitre.org/data/definitions/285.html
cwe.mitre.org/data/definitions/327.html
cwe.mitre.org/data/definitions/331.html
cwe.mitre.org/data/definitions/829.html
cwe.mitre.org/data/definitions/862.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=%E2%80%8BOvarro%20TBox%20RTUs+https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03
us-cert.cisa.gov/ics/Recommended-Practices
us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03&title=%E2%80%8BOvarro%20TBox%20RTUs
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=%E2%80%8BOvarro%20TBox%20RTUs&body=www.cisa.gov/news-events/ics-advisories/icsa-23-180-03