CVE-2023-36608 : The affected TBox RTUs store hashed passwords using MD5 encryption, which is an

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.

Published 2023-07-03 20:15:09

Updated 2023-07-10 16:06:24

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2023-36608

Ovarro » Tbox Ms-cpu32 Firmware
Versions from including (>=) 1.46 and up to, including, (<=) 1.50.598
cpe:2.3:o:ovarro:tbox_ms-cpu32_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ovarro » Tbox Ms-cpu32 » Version: N/A
Ovarro » Tbox Ms-cpu32-s2 Firmware
Versions from including (>=) 1.46 and up to, including, (<=) 1.50.598
cpe:2.3:o:ovarro:tbox_ms-cpu32-s2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ovarro » Tbox Ms-cpu32-s2 » Version: N/A
Ovarro » Tbox Rm2 Firmware
Versions from including (>=) 1.46 and up to, including, (<=) 1.50.598
cpe:2.3:o:ovarro:tbox_rm2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ovarro » Tbox Rm2 » Version: N/A
Ovarro » Tbox Tg2 Firmware
Versions from including (>=) 1.46 and up to, including, (<=) 1.50.598
cpe:2.3:o:ovarro:tbox_tg2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ovarro » Tbox Tg2 » Version: N/A
Ovarro » Tbox Lt2 Firmware
Versions from including (>=) 1.46 and up to, including, (<=) 1.50.598
cpe:2.3:o:ovarro:tbox_lt2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ovarro » Tbox Lt2 » Version: N/A

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Assigned by: ics-cert@hq.dhs.gov (Primary)

Jump to