Lucene search

IcscertCVE-2023-28649

HistoryMay 22, 2023 - 8:15 p.m.

CVE-2023-28649

2023-05-2220:15:10

CWE-20

icscert

web.nvd.nist.gov

cve-2023-28649

snap one

ovrc

cloud platform

hub

vulnerability

device management

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

44.1%

JSON

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.

Affected configurations

Nvd

Node

snaponeorvcRange<7.3.0pro

AND

snaponeovrc-300-proMatch-

VendorProductVersionCPE
snaponeorvc*cpe:2.3:a:snapone:orvc:*:*:*:*:*:pro:*:*
snaponeovrc-300-pro-cpe:2.3:h:snapone:ovrc-300-pro:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
snapone	orvc	*	cpe:2.3:a:snapone:orvc::::::pro::*
snapone	ovrc-300-pro	-	cpe:2.3:h:snapone:ovrc-300-pro:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OvrC Cloud",
    "vendor": "Snap One",
    "versions": [
      {
        "lessThan": "7.3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-136-01

www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

44.1%

JSON

Related for CVE-2023-28649