What’s Vulnerable › Vulnerabilities

CVE-2021-22642: Ovarro TBox Uncontrolled Resource Consumption

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-28 · updated 2026-06-17
• Weakness: CWE-400

Description

An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.

Affected products

• Ovarro Tbox Lt2-530 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Lt2-532 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Lt2-540 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Ms-Cpu32-S2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Ms-Cpu32 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Rm2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Tg2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Twinsoft: before 12.4 — fixed in 12.4

How to fix

Upgrade to a fixed version: Ovarro Tbox Lt2-530 Firmware 1.46; Ovarro Tbox Lt2-532 Firmware 1.46; Ovarro Tbox Lt2-540 Firmware 1.46; Ovarro Tbox Ms-Cpu32-S2 Firmware 1.46; Ovarro Tbox Ms-Cpu32 Firmware 1.46; Ovarro Tbox Rm2 Firmware 1.46; Ovarro Tbox Tg2 Firmware 1.46; Ovarro Twinsoft 12.4. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04

Get alerted when CVE-2021-22642 or the next vulnerability affects your stack