SB2021032407 - Multiple vulnerabilities in Ovarro TBox

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2021-22646)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the "ipk" package. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2021-22648)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect permission assignment for critical resource within the TBox proprietary Modbus file access functions. A remote authenticated attacker can read, alter or delete the configuration file.

3) Resource exhaustion (CVE-ID: CVE-2021-22642)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can use specially crafted invalid Modbus frames, trigger resource exhaustion and perform a denial of service (DoS) attack.

4) Insufficiently protected credentials (CVE-ID: CVE-2021-22640)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can decrypt the login password by communication capture and brute force attacks.

5) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2021-22644)

The vulnerability allows a remote attacker to disclose sensitive information on the target system.

The vulnerability exists due to the TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. A remote attacker can gain access to sensitive data on the target system.

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/icsa-21-054-04