CVE-2023-36609: Ovarro Tbox LT2 Firmware

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Affected products

• Ovarro Tbox LT2 Firmware: up to and including 1.50.598
• Ovarro Tbox Ms-CPU32-s2 Firmware: up to and including 1.50.598
• Ovarro Tbox Ms-CPU32 Firmware: up to and including 1.50.598
• Ovarro Tbox RM2 Firmware: up to and including 1.50.598
• Ovarro Tbox TG2 Firmware: up to and including 1.50.598

Published 2023-07-03. Last modified 2026-06-17.