PT-2023-18423 · Snap One · Snap One Wattbox Wb-300-Ip-3

Uri Katz · Published 2023-01-30 · Updated 2023-02-07 · CVE-2023-22315

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior

Description The issue concerns a proprietary local area network (LAN) protocol used by the device that does not verify updates. This allows an attacker to upload a malformed update file, potentially leading to the execution of arbitrary code.

Recommendations For Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior, update to a version later than WB10.9a17 to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-22315

Affected Products

Snap One Wattbox Wb-300-Ip-3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-22315 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22315 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-03 · Note