CVE-2021-22650 Ovarro TBox Relative Path Traversal
CriticalCVSS 9.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ovarro twinsoft | < 12.4 | 12.4 |
| Ovarro tbox lt2-530 firmware | < 1.46 | 1.46 |
| Ovarro tbox lt2-532 firmware | < 1.46 | 1.46 |
| Ovarro tbox lt2-540 firmware | < 1.46 | 1.46 |
| Ovarro tbox ms-cpu32 firmware | < 1.46 | 1.46 |
| Ovarro tbox ms-cpu32-s2 firmware | < 1.46 | 1.46 |
| Ovarro tbox rm2 firmware | < 1.46 | 1.46 |
| Ovarro tbox tg2 firmware | < 1.46 | 1.46 |
| Ovarro TBox | = LT2 | No fix listed |
| Ovarro TBox | = MS-CPU32 | No fix listed |
| Ovarro TBox | = MS-CPU32-S2 | No fix listed |
| Ovarro TBox | = RM2 | No fix listed |
| Ovarro TBox | = TG2 | No fix listed |
References
- www.cisa.gov third-party-advisory us-government-resource