Vendors / Snap One Records 16 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 6
CVSS high 7
Exploited now Snap One records in CISA KEV No Snap One vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 50
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00764 · Published 2023-05-22 · Fixed in 7.3 CWE-420
Priority MEDIUM 49
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00539 · Published 2023-05-22 · Fixed in 7.3 CWE-1391
Priority MEDIUM 48
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00419 · Published 2023-05-22 · Fixed in 7.3 CWE-354
Priority MEDIUM 44
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.00517 · Published 2023-05-22 · Fixed in 7.3 CWE-413
Priority MEDIUM 43
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.
CVSS 3.1 HIGH 8.3· Network · No auth · No interaction · EPSS 0.00632 · Published 2023-05-22 · Fixed in 7.3 CWE-912
Priority LOW 39
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00383 · Published 2023-05-22 · Fixed in 7.3 CWE-319
Priority LOW 31
Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection.
CVSS 3.1 HIGH 7.1· Network · No auth · User interaction · EPSS 0.0039 · Published 2023-05-22 · Fixed in 7.3 CWE-601
Priority LOW 31
When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00482 · Published 2023-05-22 · Fixed in 7.3 CWE-204
Open these records in search → All records by CVSS severity
6 7 3 0 0
THREATIST.IORead the docs