Lucene search

IcscertCVELIST:CVE-2023-31241

HistoryMay 22, 2023 - 7:26 p.m.

CVE-2023-31241

2023-05-2219:26:22

CWE-284

icscert

www.cve.org

snap one ovrc

cloud servers

vulnerability

bypass requirements

claim devices

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OvrC Cloud",
    "vendor": "Snap One",
    "versions": [
      {
        "lessThan": "7.3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-136-01

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Related for CVELIST:CVE-2023-31241