CVE-2021-22646: Ovarro Tbox LT2-530 Firmware

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

Affected products

• Ovarro Tbox LT2-530 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox LT2-532 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox LT2-540 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox Ms-CPU32-s2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox Ms-CPU32 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox RM2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox TG2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Twinsoft: before 12.4 (fixed in 12.4)

Published 2022-07-28. Last modified 2026-06-17.