CVE-2023-3395

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.32%

Published

Jul 3, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-256CWE-312

Affected Products (10)

ovarro · tbox_ms-cpu32_firmwarevulnerable

ovarro · tbox_ms-cpu32

ovarro · tbox_ms-cpu32-s2_firmwarevulnerable

ovarro · tbox_ms-cpu32-s2

ovarro · tbox_lt2_firmwarevulnerable

ovarro · tbox_lt2

ovarro · tbox_tg2_firmwarevulnerable

ovarro · tbox_tg2

ovarro · tbox_rm2_firmwarevulnerable

ovarro · tbox_rm2

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03

MitigationThird Party AdvisoryUS Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03

MitigationThird Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs