CVE-2023-40708 Improper Access Control in OPTO 22 SNAP PAC S1

The File Transfer Protocol FTP port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files...

CVE-2023-40708

OPTO 22 SNAP PAC S1 firmware vR10.3b is affected by CVE-2023-40708 due to the FTP port being open by default, potentially allowing access to some device files. Affected component: FTP service on SNAP PAC S1 (firmware R10.3b). Documented impact: attacker could access device files via network. Miti...

CVE-2023-40707 Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server

There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials...

CVE-2023-40707

CVE-2023-40707 affects OPTO 22 SNAP PAC S1 built-in web server in firmware version R10.3b, due to WEAK PASSWORD REQUIREMENTS (no complex-password enforcement). The Red Hat and NVD entries corroborate a brute-force risk (NETWORK, low attack complexity) when credentials are not strong. Documented m...

CVE-2023-40707 Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server

There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials...

CVE-2023-40706 Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server

There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login...

CVE-2023-40706

CVE-2023-40706 affects the SNAP PAC S1 built-in web server (Firmware R10.3b). The root issue is no limit on login attempts, enabling brute-force login attempts via the web interface (remote access, low attack complexity). Impact described across sources includes high confidentiality and integrity...

CVE-2023-40706 Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server

There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login...

OPTO 22 SNAP PAC S1

1. EXECUTIVE SUMMARY ​CVSS v3 7.5 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: OPTO 22 ​Equipment: SNAP PAC S1 ​Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Weak Password Requirements, Improper Access Control, Uncontrolled Resource Consumption 2...

OPTO 22 SNAP PAC S1 安全漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in OPTO 22 SNAP PAC S1 Firmware version R10.3b, which stems from an unlimited number of login attempts in the web server, allowing an attacker to brute-force the built-in web server login...

OPTO 22 SNAP PAC S1 安全漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version that stems from an improperly restricted built-in web server authentication attempt that does not mandate a complex password, which could lead to brute forc...

OPTO 22 SNAP PAC S1 资源管理错误漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version, which stems from If the controller has the built-in web server enabled, but the built-in web server is not fully setup and configured, an attacker exploiti...

OPTO 22 SNAP PAC S1 资源管理错误漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version, which stems from If the controller has the built-in web server enabled, but the built-in web server is not fully setup and configured, an attacker exploiti...

PT-2023-27607 · Opto 22 · Snap Pac S1 Firmware

Name of the Vulnerable Software and Affected Versions: SNAP PAC S1 Firmware version R10.3b Description: An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completel...

PT-2023-27604 · Opto 22 · Snap Pac S1 Firmware

Name of the Vulnerable Software and Affected Versions: SNAP PAC S1 Firmware version R10.3b Description: The issue is related to the lack of a limit on the number of login attempts in the web server. This could allow for a brute-force attack on the built-in web server login. Recommendations: For...

PT-2023-27608 · Opto 22 · Snap Pac S1 Firmware

Name of the Vulnerable Software and Affected Versions: SNAP PAC S1 Firmware version R10.3b Description: An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have...

OPTO 22 SNAP PAC S1 安全漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version that stems from the File Transfer Protocol FTP port being open by default, allowing an attacker to access certain device files...

EulerOS Virtualization 3.0.6.6 : krb5 (EulerOS-SA-2023-2426)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code...

EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2023-2434)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to...

CLSA-2023-1689701119 Fix CVE(s): CVE-2021-3738, CVE-2022-42898

SECURITY UPDATE: use after free in Samba AD DC RPC server - debian/patches/CVE-2021-3738-pre.patch: prepare service routines before fixing CVE-2021-3738 - debian/patches/CVE-2021-3738.patch: avoids a crash caused by use-after-free in Samba AD DC RPC server - CVE-2021-3738.patch SECURITY UPDATE:...