Lucene search

IcscertCVELIST:CVE-2023-28649

HistoryMay 22, 2023 - 7:10 p.m.

CVE-2023-28649

2023-05-2219:10:51

CWE-20

icscert

www.cve.org

snap one ovrc

hub

centralize

manage

vulnerability

attacker

impersonate

device requests

claim

ovrc cloud platform

validate

found devices

another user

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.1%

JSON

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OvrC Cloud",
    "vendor": "Snap One",
    "versions": [
      {
        "lessThan": "7.3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-136-01

www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.1%

JSON

Related for CVELIST:CVE-2023-28649