CVE-2023-36609

The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

• CWE-829
• CWE-829

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03Mitigation, Third Party Advisory, US Government Resource

Published

Jul 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36602Windows TCP/IP Denial of Service Vulnerability7.5
• CVE-2023-36603Windows TCP/IP Denial of Service Vulnerability7.5
• CVE-2023-36605Windows Named Pipe Filesystem Elevation of Privilege Vulnera…7.8
• CVE-2023-36606Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabi…7.5
• CVE-2023-36607The affected TBox RTUs are missing authorization for running…5.3
• CVE-2023-36608 The affected TBox RTUs store hashed passwords using MD5 enc…6.5
• CVE-2023-3661A vulnerability was found in SourceCodester AC Repair and Se…9.8
• CVE-2023-36610 ​The affected TBox RTUs generate software security tokens u…5.9
• CVE-2023-36611 The affected TBox RTUs allow low privilege users to access …6.5
• CVE-2023-36612Directory traversal can occur in the Basecamp com.basecamp.b…7.5
• CVE-2023-36617A ReDoS issue was discovered in the URI component before 0.1…5.3
• CVE-2023-36618Atos Unify OpenScape Session Border Controller through V10 R…8.8