Snap One OvrC Cloud
In Snap One OVRC cloud platform, the Hub is a device that is used to centralize and manage nested devices connected to it. A vulnerability exists where an attacker can impersonate a hub and send device requests to claim already claimed devices. The OVRC cloud platform receives the requests but does not validate if the found devices are already managed by another user. CVE-2023-28649 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). When supplying Snap One OVRC cloud servers with a random MAC address, it will return information about the device. The MAC address of devices can be enumerated in an attack and their information will be disclosed by the OVRC cloud.   CVE-2023-28412 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Snap One OVRC cloud servers contain a route that can be exploited where an attacker can use to bypass requirements and claim devices outright.   CVE-2023-31241 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Snap One OvrC Pro versions prior to 7.3 utilize HTTP connections when downloading a program from their servers. Because it does not use HTTPS, OVRC Pro devices are susceptible to exploitation. CVE-2023-31193 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Snap One OVRC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system and lack of firmware signature could allow attackers to upload arbitrary firmware updates resulting in code execution.  CVE-2023-28386 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Devices using Snap One OVRC cloud are sent to web address when accessing a web management interface utilizing a HTTP connection. It is possible for attackers to impersonate a device and supply malicious information about the device’s web server interface. By supplying malicious parameters, an attacker could redirect the user to arbitrary and dangerous locations on the web. CVE-2023-31245 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account that is accessible through hard-coded credentials.  CVE-2023-31240 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that allows a user to execute arbitrary commands on the hub device.  CVE-2023-25183 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).