CVE-2021-22640
28.07.2022, 15:15
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ovarro | twinsoft | 𝑥 < 12.4 |
| ovarro | tbox_lt2-530_firmware | 𝑥 < 1.46 |
| ovarro | tbox_lt2-532_firmware | 𝑥 < 1.46 |
| ovarro | tbox_lt2-540_firmware | 𝑥 < 1.46 |
| ovarro | tbox_ms-cpu32_firmware | 𝑥 < 1.46 |
| ovarro | tbox_ms-cpu32-s2_firmware | 𝑥 < 1.46 |
| ovarro | tbox_rm2_firmware | 𝑥 < 1.46 |
| ovarro | tbox_tg2_firmware | 𝑥 < 1.46 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-294 - Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.