CVE-2023-28412 (GCVE-0-2023-28412)
Vulnerability from cvelistv5 – Published: 2023-05-22 19:24 – Updated: 2025-01-16 21:33
VLAI?
Summary
When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.
Severity ?
5.3 (Medium)
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Snap One | OvrC Cloud |
Affected:
0 , < 7.3
(custom)
|
Credits
Uri Katz of Claroty reported these vulnerabilities to CISA.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:38:25.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T20:55:42.498843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T21:33:55.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OvrC Cloud",
"vendor": "Snap One",
"versions": [
{
"lessThan": "7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Uri Katz of Claroty reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\u003c/p\u003e\u003cbr\u003e\n\n\u003cbr\u003e\n\n\u003cbr\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "\n\n\n\n\n\n\n\n\nWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\n\n\n\n\n\n\n\n\n\n\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable Response Discrepancy ",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-22T19:24:06.082Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eSnap One has released the following updates/fixes for the affected products:\u003c/p\u003e\u003cul\u003e\u003cli\u003eOvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eOvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eDisable UPnP.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see Snap One\u2019s \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf\"\u003eRelease Notes\u003c/a\u003e.\u003c/p\u003e\n\n"
}
],
"value": "\nSnap One has released the following updates/fixes for the affected products:\n\n * OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\n * OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\n * Disable UPnP.\n\n\nFor more information, see Snap One\u2019s Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .\n\n\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-28412",
"datePublished": "2023-05-22T19:24:06.082Z",
"dateReserved": "2023-04-26T19:18:23.279Z",
"dateUpdated": "2025-01-16T21:33:55.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:snapone:orvc:*:*:*:*:*:pro:*:*\", \"versionEndExcluding\": \"7.3.0\", \"matchCriteriaId\": \"415E3C3D-6B2F-4095-B7F1-E3F777E01172\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:control4:ca-1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"910274AB-35AF-428C-84D7-36774DEB59D8\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:control4:ca-10:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"852189C9-7720-468D-BCE0-28DFC051AEDC\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:control4:ea-1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C61FA2AE-A962-4D60-BBCF-751FDB5215B9\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:control4:ea-3:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6310809-0890-4113-837C-0074706B4E6B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:control4:ea-5:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7ADAAF7-9B0B-4002-8158-FC6B0EAB6055\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:an-110-rt-2l1w:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B5B50505-B496-4172-813E-CA174EE2D4DF\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:an-110-rt-2l1w-wifi:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04744281-B935-4272-8582-85C6162881F8\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:an-310-rt-4l2w:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CCD83E46-F84F-49F8-9601-ABC03292E0F6\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:ovrc-300-pro:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5B44DFB-CC8D-4342-907B-D34F9EAB5CEB\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:pakedge_rk-1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2982D38-80BF-4041-9F59-D26C152D24D9\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:pakedge_rt-3100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"061055F0-D742-4227-ADC2-1793979F9463\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:snapone:pakedge_wr-1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF7BD251-BB2F-4C49-8B1E-8EB26580DFDB\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"\\n\\n\\n\\n\\n\\n\\n\\n\\nWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\"}]",
"id": "CVE-2023-28412",
"lastModified": "2024-11-21T07:55:00.973",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
"published": "2023-05-22T20:15:10.330",
"references": "[{\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}]",
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-204\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-203\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-28412\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2023-05-22T20:15:10.330\",\"lastModified\":\"2024-11-21T07:55:00.973\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\n\\n\\n\\n\\n\\n\\n\\n\\nWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-204\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:snapone:orvc:*:*:*:*:*:pro:*:*\",\"versionEndExcluding\":\"7.3.0\",\"matchCriteriaId\":\"415E3C3D-6B2F-4095-B7F1-E3F777E01172\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:control4:ca-1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"910274AB-35AF-428C-84D7-36774DEB59D8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:control4:ca-10:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"852189C9-7720-468D-BCE0-28DFC051AEDC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:control4:ea-1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C61FA2AE-A962-4D60-BBCF-751FDB5215B9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:control4:ea-3:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6310809-0890-4113-837C-0074706B4E6B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:control4:ea-5:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7ADAAF7-9B0B-4002-8158-FC6B0EAB6055\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:an-110-rt-2l1w:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5B50505-B496-4172-813E-CA174EE2D4DF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:an-110-rt-2l1w-wifi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04744281-B935-4272-8582-85C6162881F8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:an-310-rt-4l2w:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCD83E46-F84F-49F8-9601-ABC03292E0F6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:ovrc-300-pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5B44DFB-CC8D-4342-907B-D34F9EAB5CEB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:pakedge_rk-1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2982D38-80BF-4041-9F59-D26C152D24D9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:pakedge_rt-3100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"061055F0-D742-4227-ADC2-1793979F9463\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:snapone:pakedge_wr-1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF7BD251-BB2F-4C49-8B1E-8EB26580DFDB\"}]}]}],\"references\":[{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T12:38:25.285Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-28412\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-16T20:55:42.498843Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-16T20:55:43.954Z\"}}], \"cna\": {\"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Uri Katz of Claroty reported these vulnerabilities to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Snap One\", \"product\": \"OvrC Cloud\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"\\nSnap One has released the following updates/fixes for the affected products:\\n\\n * OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\\n * OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\\n * Disable UPnP.\\n\\n\\nFor more information, see Snap One\\u2019s Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\n\u003cp\u003eSnap One has released the following updates/fixes for the affected products:\u003c/p\u003e\u003cul\u003e\u003cli\u003eOvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eOvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eDisable UPnP.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see Snap One\\u2019s \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf\\\"\u003eRelease Notes\u003c/a\u003e.\u003c/p\u003e\\n\\n\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01\"}, {\"url\": \"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\n\\n\\n\\n\\n\\n\\n\\n\\nWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\n\u003cp\u003e\u003c/p\u003e\\n\\n\u003cp\u003e\u003c/p\u003e\\n\\n\u003cp\u003eWhen supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.\u003c/p\u003e\u003cbr\u003e\\n\\n\u003cbr\u003e\\n\\n\u003cbr\u003e\\n\\n\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-204\", \"description\": \"CWE-204 Observable Response Discrepancy \"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2023-05-22T19:24:06.082Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-28412\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-16T21:33:55.805Z\", \"dateReserved\": \"2023-04-26T19:18:23.279Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2023-05-22T19:24:06.082Z\", \"assignerShortName\": \"icscert\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…