CVEvulnerability

CVE-2023-36610

5.9 MEDIUM Published 2023-07-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-331

Description

​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.

Affected configurations

• ovarro tbox ms-cpu32 firmware (<= 1.50.598) • ovarro tbox ms-cpu32-s2 firmware (<= 1.50.598) • ovarro tbox lt2 firmware (<= 1.50.598) • ovarro tbox tg2 firmware (<= 1.50.598) • ovarro tbox rm2 firmware (<= 1.50.598)

Related

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References