Vulnerability · Published May 22, 2023 · Assigned by icscert
CVE-2023-28649
High 8.6
In plain English
A high-severity security flaw in OvrC Cloud from Snap One. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Snap One | OvrC Cloud | 0 – before 7.3 |
Weakness: CWE-413 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H