​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files…

Description

​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.

Scores

EPSS (exploitation in 30 days)

0.32% · top 75% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-256 Plaintext Storage of a Password (opens in a new tab)All about CWE-256 and its CVEs
• CWE-312 (opens in a new tab)All about CWE-312 and its CVEs

Affected products

• Ovarro · TBox MS-CPU32

  • affected ≤ 1.50.598

• Ovarro · ​TBox MS-CPU32-S2

  • affected ≤ 1.50.598

• Ovarro · TBox LT2

  • affected ≤ 1.50.598

• Ovarro · TBox TG2

  • affected ≤ 1.50.598

• Ovarro · TBox RM2

  • affected ≤ 1.50.598

References (1)

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03 (opens in a new tab)government-resourcex_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-3395](https://trackcve.app/badge/CVE-2023-3395.svg)](https://trackcve.app/cve/CVE-2023-3395)

Record last updated 24 Oct 2024, 19:53 UTC.