An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.

ovarro

Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.

ovarro

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

ovarro