CVE-2024-50380: Authentication Bypass by Spoofing in Snap One OVRC cloud

Published Dec 2, 2024

Updated

Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device.

Affected Software

1 affected component

Snap One OVRC cloud

Remediation

Information

Snap One has released the following updates/fixes for the affected products: * OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud. * OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud. * Disable UPnP. For more information, see Snap One’s Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .

Event History

Dec 2, 2024

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-50380?

CVE-2024-50380 has a high severity rating due to potential unauthorized access to sensitive device information.

How do I fix CVE-2024-50380?

To fix CVE-2024-50380, ensure that your Snap One OVRC cloud system is updated to the latest version provided by the vendor.

What type of attack does CVE-2024-50380 enable?

CVE-2024-50380 enables impersonation attacks where an attacker can exploit enumerated MAC addresses to access sensitive information.

What are the implications of CVE-2024-50380 for network security?

The implications of CVE-2024-50380 for network security include the risk of data exposure and potential loss of device control.

Is there a workaround for CVE-2024-50380?

Currently, the best course of action for CVE-2024-50380 is to implement recommended security measures until an official patch is released.