CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

CVE-2023-31193

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation...

CVE-2023-31193

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation...

CVE-2023-31193

CVE-2023-31193 concerns Snap One OvrC Pro prior to version 7.3, where firmware/programs are downloaded over HTTP instead of HTTPS. This weakens transport security and can enable exploitation affecting OvrC Pro devices. The public material specifies the vulnerability as a cleartext transmission is...

CVE-2023-31241

CVE-2023-31241 affects Snap One OvrC cloud services (OvrC Pro/Connect). The issue is an access-control route that lets an attacker bypass requirements and claim unclaimed devices by bypassing the serial-number check. Root cause: improper access controls/identity checks in the device-to-cloud inte...

CVE-2023-31241

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright...

CVE-2023-31241

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright...

CVE-2023-28412

The CVE-2023-28412 entry describes an information disclosure vulnerability in the Snap One OvrC cloud platform. When a random MAC address is supplied, the OvrC cloud servers enumerate the MAC and disclose device information, enabling an attacker to obtain data about devices connected to the cloud...

CVE-2023-28412

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information...

CVE-2023-28412

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information...

CVE-2023-28649

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but do...

CVE-2023-28649

CVE-2023-28649 affects Snap One OvrC cloud platform hubs (OvrC Pro/Connect). A input-validation flaw lets an attacker impersonate a hub to send device-claim requests and bypass checks for devices already managed by another user, enabling potential unauthorized access and, per advisory context, po...

PT-2023-19964 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue allows users to execute arbitrary commands on the hub device when logged into the superuser account, due to a new functionality that appears in affected versions. Recommendations:...

PT-2023-21700 · Snap One · Snap One Ovrc

Name of the Vulnerable Software and Affected Versions: Snap One OvrC affected versions not specified Description: The issue allows an attacker to enumerate device MAC addresses and obtain information about the devices from the Snap One OvrC cloud servers. When a random MAC address is provided, th...

PT-2023-21873 · Ovrc · Ovrc

Name of the Vulnerable Software and Affected Versions: OvrC cloud platform affected versions not specified Description: A vulnerability exists in the OvrC cloud platform where an attacker could impersonate a hub and send device requests to claim already claimed devices. The platform does not...

PT-2023-23262 · Snap One · Snap One Ovrc

Name of the Vulnerable Software and Affected Versions: Snap One OvrC affected versions not specified Description: The issue concerns Snap One OvrC cloud servers, where an attacker can exploit a route to bypass requirements and claim devices outright. No information is provided about the estimated...

PT-2023-21687 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro devices versions 7.2 and prior Description: The issue arises from the device's failure to properly validate firmware updates, relying solely on the calculation of the MD5 hash of the firmware without utilizing a private-publ...

Snap One OvrC Pro 安全漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A security vulnerability exists in Snap One OvrC Pro prior to version 7.3, which stems from a vulnerability that could allow a user to execute arbitrary commands on a hub device when logged in as a...

Snap One OvrC Cloud 存在输入验证错误漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from US-based Snap One. Snap One OvrC Cloud suffers from an input validation error vulnerability that originates from a URL redirection to an untrusted site, which can be exploited by an attacker to redirect a user to a...

Snap One OvrC Pro 数据伪造问题漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A data forgery issue vulnerability exists in Snap One OvrC Pro 7.2 and prior versions, which stems from the lack of a complete PKI system firmware signature, and can be exploited by an attacker to...