CVE-2023-36608
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Affected TBox RTUs store hashed passwords using MD5 encryption, which is considered insecure.
Risk Assessment
Using MD5 for password storage exposes the organization to attacks such as password cracking, potentially leading to unauthorized access to systems.
Recommendation
It is recommended to migrate to more secure hashing algorithms like bcrypt or Argon2 to protect credential data.
Other vulnerabilities in TBox RTUs
See all- CVE-2023-36611Medium
Affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. An attacker with 'user' privileges could access files requiring higher privileges by establishing an SSH session and providing the other tokens.
- CVE-2023-36609High
Affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
Original NVD description (English source)
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS