Monday, December 4, 2023

Flaws with Ovarro’s TBox Remote Terminal Units Opens Industrial Systems For Remote Attacks

Recently, on March 23, the United States Computer Emergency Readiness Team (US-CERT) has proclaimed that in “Ovarro TBox” several vulnerabilities have been detected.

According to cybersecurity analysts, the exploitation of these vulnerabilities could generally enable threat actors to remotely execute code or execute a distributed denial-of-service (DDoS).

Flaws Detected

  • CVE-2021-22646 – Improper control of generation of code (‘CODE INJECTION’) (CWE-94).
  • CVE-2021-22648 – Incorrect permission assignment for the critical resource (CWE-732).
  • CVE-2021-22642 – Uncontrolled resource consumption (CWE-400).
  • CVE-2021-22640 – Insufficiently protected credentials (CWE-522).
  • CVE-2021-22644 – Use of hard-coded cryptographic key (CWE-321). 

Risk Assessment

All the risk that is linked with these vulnerabilities is not only the integrity of automation processes but also, in some cases public safety. 

However, utilizing all the security shortcomings will surely help to find some web-based interfaces, just like HMIs. It generally monitors process levels and other industrial activity. 

The experts asserted that they have noticed in the past what could go incorrect when such an interface is disclosed to the internet outwardly any security.

Here, the fact of such interfaces are exposed online and excludes many such obstacles to entry for opponents of all types of vulnerabilities.

But, the successful exploitation of these vulnerabilities could result in remote code execution, which may create a denial-of-service situation.

Products That are Affected

The affected products that are targeted by the attackers in this attack are mentioned below:-

  • TBoxLT2 (All models)
  • TBox TG2 (All models)
  • TBox MS-CPU32
  • TBox MS-CPU32-S2
  • TBox RM2 (All models)
  • All the versions prior to TWinSoft 12.4 and Firmware 1.46


This vulnerability has been listed as one of the most important vulnerabilities, along with a CVSS v3 score of 8.8. The security researchers have requested to note that these vulnerabilities have a low skill level that needs to exploit them, and can be exploited remotely. 

In case the users are using the applicable product, in that situation, it is quite beneficial to investigate the influence and orderly update to the version in which the issue is fixed.

Apart from this, CISA has recommended users to follow some basic precautions from their side, as this will surely help them to minimize the risk of exploitation of these vulnerabilities.

Reduce the network exposure for all control system devices, and also make sure that they are not available from the internet. Even users must locate the control system networks and remote devices behind firewalls and separate them from the business network.

In case of remote access is needed, then one should always use secure methods, like Virtual Private Networks (VPNs). However, acknowledging VPNs may have vulnerabilities and should be updated to the most popular version that is available. 

Not only this, but CISA has also provided a full section that only suggests the control systems security, which are recommended workouts on the ICS webpage on

Moreover, there are several suggested methods that are generally available for examination and download, which also include Improving Industrial Control Systems Cybersecurity with Defense-in-Depth techniques.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles