Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 | Third Party Advisory US Government Resource |
| https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf | Release Notes |
Configurations
History
30 May 2023, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf - Release Notes | |
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - Third Party Advisory, US Government Resource | |
| First Time |
Snapone orvc
Snapone |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:snapone:orvc:*:*:*:*:*:pro:*:* |
Information
Published : 2023-05-22 20:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-31193
Mitre link : CVE-2023-31193
CVE.ORG link : CVE-2023-31193
JSON object : View
Products Affected
snapone
- orvc
CWE
CWE-319
Cleartext Transmission of Sensitive Information