Critical severity · published May 22, 2023
CVE-2023-28386
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
Orvc · Snapone
before 7.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28386
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01
Release Notes
https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf
More from Orvc
10.0
CVE-2023-31241
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright
9.8
CVE-2023-31240
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely
8.7
CVE-2024-50380
Authentication Bypass by Spoofing in Snap One OVRC cloud
7.5
CVE-2023-31193
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers
7.5
CVE-2023-28649
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it