CVE-2023-28649: Input Validation

Q: What is the severity of CVE-2023-28649?

CVE-2023-28649 has been classified with a critical severity level due to the potential for an attacker to impersonate a hub and manipulate device requests.

Q: How do I fix CVE-2023-28649?

To fix CVE-2023-28649, users should upgrade the Snap One OvrC Pro to version 7.3 or later to mitigate the vulnerability.

Q: What devices are affected by CVE-2023-28649?

CVE-2023-28649 affects the Snap One OvrC Pro with versions up to 7.3.

Q: What is the impact of CVE-2023-28649?

The impact of CVE-2023-28649 allows unauthorized device claims and potential overall system compromise.

Q: Is there a workaround for CVE-2023-28649?

Currently, there are no known workarounds for CVE-2023-28649 aside from applying the recommended software updates.

Published May 22, 2023

Updated

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.

Affected Software

5 affected componentsFixes available

Snap One OvrC Pro<7.3

7.3

Snapone Orvc Pro<7.3.0

Snapone Ovrc-300-pro

All of the following

Snapone Orvc Pro<7.3.0

Snapone Ovrc-300-pro

Remediation

Information

* OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud. * OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud. * Disable UPnP.

Event History

May 22, 2023

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-136-01

Frequently Asked Questions

What is the severity of CVE-2023-28649?