CVE-2023-40709

2023-08-2417:15:09

CWE-400

[email protected]

web.nvd.nist.gov

cve-2023-40709

icmp

device crash

web server

snap pac s1 firmware

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b

Affected configurations

NVD

Node

opto22snap_pac_s1_firmwareMatchr10.3b

AND

opto22snap_pac_s1Match-

CPENameOperatorVersion
opto22:snap_pac_s1_firmwareopto22 snap pac s1 firmwareeqr10.3b

CPE	Name	Operator	Version
opto22:snap_pac_s1_firmware	opto22 snap pac s1 firmware	eq	r10.3b

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SNAP PAC S1",
    "vendor": "OPTO 22",
    "versions": [
      {
        "status": "affected",
        "version": "R10.3b"
      }
    ]
  }
]