CVE-2023-31240
Assigner: icscert
Published: 2023-05-22T19:58:48.755Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: OvrC Cloud
vendor: Snap One
versions: lessThan: 7.3
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Uri Katz of Claroty reported these vulnerabilities to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p></p>

<p></p>

<p></p>

<p></p>

<p>

</p><p>

</p><p>

</p><p>Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.</p>

<p></p>

<p></p>

<p></p>

<p></p>
value: 




























Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.


















metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-798
description: CWE-798 Use of Hard-coded Credentials
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>Snap One has released the following updates/fixes for the affected products:</p><ul><li>OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.</li><li>OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.</li><li>Disable UPnP.</li></ul><p>For more information, see Snap One’s <a target="_blank" rel="nofollow" href="https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf">Release Notes</a>.</p>


value: 
Snap One has released the following updates/fixes for the affected products:

  *  OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.
  *  OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.
  *  Disable UPnP.


For more information, see Snap One’s  Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .




source: discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev