Security readout for executives and security teams
Plain-English summary
Some Ovarro TBox RTUs store password hashes with MD5, a weak algorithm. If an attacker already has low-privileged network access and can obtain those hashes, password confidentiality could be exposed. The supplied sources do not state active exploitation.
Executive priority
Treat this as a moderate OT credential-protection issue. Prioritize where these RTUs support critical operations or where management access is broadly reachable.
Technical view
CVE-2023-36608 is CWE-327 in Ovarro TBox MS-CPU32, MS-CPU32-S2, LT2, TG2, and RM2 version 1.46. CVSS 3.1 is 6.5: network reachable, low attack complexity, low privileges required, no user interaction, high confidentiality impact only.
Likely exposure
Exposure is most likely in OT environments running the listed Ovarro TBox RTU models at version 1.46, especially where management interfaces are reachable by non-administrative users.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation or a public exploit. Practical abuse appears to depend on authenticated access and access to stored password hashes.
Researcher notes
The bundle describes insecure MD5 password hashing but does not include vendor patch details, exploit artifacts, or storage-access specifics. Avoid assuming impact beyond confidentiality without additional vendor evidence.
Mitigation direction
- Check CISA and Ovarro guidance for supported firmware or vendor-approved mitigations.
- Restrict RTU management access to trusted OT administration networks.
- Review and reduce low-privilege accounts with access to affected devices.
- Rotate credentials after remediation if hash exposure is suspected.
Validation and detection
- Inventory Ovarro TBox RTU models and firmware versions.
- Confirm whether any listed device is running version 1.46.
- Review network paths to RTU management interfaces.
- Check account roles with low-privilege access to affected devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-327: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-36608 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of a Broken or Risky Cryptographic Algorithm
Use of a Broken or Risky Cryptographic Algorithm represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.