PT-2022-9260 · Ovarro · Ovarro Tbox

Uri Katz · Published 2022-07-28 · Updated 2022-08-04 · CVE-2021-22646

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ovarro TBox (affected versions not specified)

Description The issue allows malicious code execution by uploading, extracting, and executing the "ipk" package containing the configuration created by TWinSoft in Ovarro TBox.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-22646

Affected Products

Ovarro Tbox

References · 4

• https://osv.dev/vulnerability/CVE-2021-22646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22646 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-054-04 · Note
• https://t.me/cibsecurity/47201 · Telegram Post