CVE-2021-22650: Ovarro Tbox LT2-530 Firmware

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.

Affected products

• Ovarro Tbox LT2-530 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox LT2-532 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox LT2-540 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox Ms-CPU32-s2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox Ms-CPU32 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox RM2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Tbox TG2 Firmware: before 1.46 (fixed in 1.46)
• Ovarro Twinsoft: before 12.4 (fixed in 12.4)

Published 2022-07-28. Last modified 2026-06-17.