Vulnerabilities

TI-2023-10644 CVE-2023-25183 · GHSA-jm76-f53m-v476

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new…

MEDIUM 43

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00632 Published 2023-05-22 Fixed in 7.3 CWE-912

TI-2023-14946 CVE-2023-31240 · GHSA-65fr-gpw6-j777

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server…

MEDIUM 49

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00539 Published 2023-05-22 Fixed in 7.3 CWE-1391

TI-2023-14950 CVE-2023-31245 · GHSA-pr3p-m4hm-wqv2

Open redirect in Snap One OvrC Cloud

LOW 31

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0039 Published 2023-05-22 Fixed in 7.3 CWE-601

TI-2023-12932 CVE-2023-28386 · GHSA-pvcj-xvm2-wgmw

Insufficient verification of data authenticity in Snap One OvrC Cloud

MEDIUM 48

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00419 Published 2023-05-22 Fixed in 7.3 CWE-354

TI-2023-14903 CVE-2023-31193 · GHSA-45ff-cx94-f6g5

Cleartext transmission of sensitive information in Snap One OvrC Cloud

LOW 39

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00383 Published 2023-05-22 Fixed in 7.3 CWE-319

TI-2023-14947 CVE-2023-31241 · GHSA-8hjj-wf8c-mhwq

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.

MEDIUM 50

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00764 Published 2023-05-22 Fixed in 7.3 CWE-420

TI-2023-12957 CVE-2023-28412 · GHSA-258m-ggv2-xxv3

Observable discrepancy in Snap One OvrC Cloud

LOW 31

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2023-05-22 Fixed in 7.3 CWE-204

TI-2023-13167 CVE-2023-28649 · GHSA-rcv8-v727-xg26

Improper input validation in Snap One OvrC Cloud

MEDIUM 44

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00517 Published 2023-05-22 Fixed in 7.3 CWE-413

Vulnerabilities

Filters