CVE-2023-25183

CVE-2023-25183 affects Snap One OvrC Pro prior to version 7.2. The vulnerability arises from a hidden/extra functionality accessible when logged in as the superuser, which could allow an attacker to execute arbitrary commands on the hub device. Multiple sources classify the impact as high, with p...

CVE-2023-25183

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device...

CVE-2023-31240

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...

CVE-2023-31240

Summary: CVE-2023-31240 affects Snap One OvrC Pro, specifically versions prior to 7.2. The issue is a hard-coded-credentials based hidden superuser account, accessible via the local web server running on affected devices, potentially exposing control to the network and remote access. The Red Hat/...

CVE-2023-28386

CVE-2023-28386 affects Snap One OvrC Pro devices (7.2 and earlier). The root cause is improper firmware update validation: only the MD5 hash is checked, with no PKI-based firmware signature verification, enabling upload of arbitrary firmware and remote code execution. Public details in multiple s...

CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

CVE-2023-31193

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation...

CVE-2023-31193

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation...

CVE-2023-31193

CVE-2023-31193 concerns Snap One OvrC Pro prior to version 7.3, where firmware/programs are downloaded over HTTP instead of HTTPS. This weakens transport security and can enable exploitation affecting OvrC Pro devices. The public material specifies the vulnerability as a cleartext transmission is...

PT-2023-19964 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue allows users to execute arbitrary commands on the hub device when logged into the superuser account, due to a new functionality that appears in affected versions. Recommendations:...

PT-2023-21687 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro devices versions 7.2 and prior Description: The issue arises from the device's failure to properly validate firmware updates, relying solely on the calculation of the MD5 hash of the firmware without utilizing a private-publ...

Snap One OvrC Pro 数据伪造问题漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A data forgery issue vulnerability exists in Snap One OvrC Pro 7.2 and prior versions, which stems from the lack of a complete PKI system firmware signature, and can be exploited by an attacker to...

Snap One OvrC Pro 安全漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A security vulnerability exists in Snap One OvrC Pro versions prior to 7.3 that stems from not using an HTTPS connection, which can be exploited by an attacker to compromise an OvrC Pro device...

Snap One OvrC Pro 安全漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A security vulnerability exists in Snap One OvrC Pro prior to version 7.3, which stems from a vulnerability that could allow a user to execute arbitrary commands on a hub device when logged in as a...

Snap One OvrC Pro 信任管理问题漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from US-based Snap One. A trust management issue vulnerability exists in Snap One OvrC Pro prior to version 7.2 that stems from the use of hard-coded credentials, which can be exploited by an attacker to gain access to ...

Snap One OvrC Cloud (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Snap One Equipment: OvrC Cloud, OvrC Pro Devices Vulnerabilities: Improper Input Validation, Observable Response Discrepancy, Improper Access Control, Cleartext Transmission of Sensitive Information,...