CVE-2021-22646
High
Description
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
SeverityHigh
CVSS8.8
Exploit probability—
ProductOvarro Twinsoft
PublishedJul 28, 2022
First seenJul 28, 2022
Weakness typeCWE-94Code injection
How to fix
Update
- ovarro twinsoft12.4 or later
- ovarro tbox_lt2-530_firmware1.46 or later
- ovarro tbox_lt2-532_firmware1.46 or later
- ovarro tbox_lt2-540_firmware1.46 or later
- ovarro tbox_ms-cpu32_firmware1.46 or later
- ovarro tbox_ms-cpu32-s2_firmware1.46 or later
- ovarro tbox_rm2_firmware1.46 or later
- ovarro tbox_tg2_firmware1.46 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ovarro twinsoft | v < 12.4 | 12.4 |
| ovarro tbox_lt2-530_firmware | v < 1.46 | 1.46 |
| ovarro tbox_lt2-532_firmware | v < 1.46 | 1.46 |
| ovarro tbox_lt2-540_firmware | v < 1.46 | 1.46 |
| ovarro tbox_ms-cpu32_firmware | v < 1.46 | 1.46 |
| ovarro tbox_ms-cpu32-s2_firmware | v < 1.46 | 1.46 |
| ovarro tbox_rm2_firmware | v < 1.46 | 1.46 |
| ovarro tbox_tg2_firmware | v < 1.46 | 1.46 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.