CVE-2023-22315
Assigner: icscert
Published: 2023-01-30T21:58:38.264Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Wattbox WB-300-IP-3
vendor: Snap One
versions: lessThanOrEqual: WB10.9a17
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Uri Katz of Claroty Research reported these vulnerabilities to CISA. 
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An attacker could upload a malformed update file to the device and execute arbitrary code. </p><br>


value: 
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An attacker could upload a malformed update file to the device and execute arbitrary code. 





metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>Snap One has released the following updates for the affected products: </p><ul><li>Version <a target="_blank" rel="nofollow" href="https://app.ovrc.com/#/user-settings">WB10.B929</a>&nbsp;(login required) </li></ul>

<br>
value: 
Snap One has released the following updates for the affected products: 

  *  Version  WB10.B929 https://app.ovrc.com/#/user-settings  (login required) 






source: discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev