CVE-2023-28386: Critical severity snap one ovrc vulnerability
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28386?
CVE-2023-28386 has a critical severity rating due to its potential to allow attackers to perform unauthorized firmware updates.
How do I fix CVE-2023-28386?
To fix CVE-2023-28386, upgrade to Snap One OvrC Pro version 7.3 or later, which includes the necessary firmware validation improvements.
What devices are affected by CVE-2023-28386?
CVE-2023-28386 affects Snap One OvrC Pro devices running versions up to 7.2.
What type of attack can exploit CVE-2023-28386?
CVE-2023-28386 can be exploited to perform unauthorized firmware updates, compromising device integrity.
Is there a workaround for CVE-2023-28386?
There are no known effective workarounds for CVE-2023-28386, making the upgrade to the fixed version the only recommended solution.