What’s Vulnerable › Vulnerabilities

CVE-2021-22646: Ovarro TBox Code Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-28 · updated 2026-06-17
• Weakness: CWE-94

Description

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

Affected products

• Ovarro Tbox Lt2-530 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Lt2-532 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Lt2-540 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Ms-Cpu32-S2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Ms-Cpu32 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Rm2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Tbox Tg2 Firmware: before 1.46 — fixed in 1.46
• Ovarro Twinsoft: before 12.4 — fixed in 12.4

How to fix

Upgrade to a fixed version: Ovarro Tbox Lt2-530 Firmware 1.46; Ovarro Tbox Lt2-532 Firmware 1.46; Ovarro Tbox Lt2-540 Firmware 1.46; Ovarro Tbox Ms-Cpu32-S2 Firmware 1.46; Ovarro Tbox Ms-Cpu32 Firmware 1.46; Ovarro Tbox Rm2 Firmware 1.46; Ovarro Tbox Tg2 Firmware 1.46; Ovarro Twinsoft 12.4. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04

Get alerted when CVE-2021-22646 or the next vulnerability affects your stack