Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2021-22650

Ovarro TBox Relative Path Traversal

High7.5EPSS 1.4%
Published
Updated
Reserved
Assigned by
icscert

Description

An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.

Scores

CVSS scores of CVE-2021-22650, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.4% · top 28% of all CVEs (4 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • Ovarro · TBox

    • affected LT2
    • affected MS-CPU32
    • affected MS-CPU32-S2
    • affected RM2
    • affected TG2

What to do

Solution: Ovarro recommends affected users update to 12.5 or later of TWinSoft to mitigate these vulnerabilities. The latest version can be found on www.ovarro.com in the customer support section (service portal).

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2021-22650 badge
[![CVE-2021-22650](https://trackcve.app/badge/CVE-2021-22650.svg)](https://trackcve.app/cve/CVE-2021-22650)

Record last updated .