PT-2023-18481 · Snap One · Snap One Wattbox Wb-300-Ip-3

Uri Katz · Published 2023-01-30 · Updated 2023-02-07 · CVE-2023-22389

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior

Description The issue concerns the storage of passwords in a plaintext file when the device configuration is exported via Save/Restore–>Backup Settings. This could allow any user accessing the file to read the passwords.

Recommendations For versions WB10.9a17 and prior, consider restricting access to the exported configuration files to minimize the risk of password exposure. As a temporary workaround, avoid using the Save/Restore–>Backup Settings feature until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-256

Related Identifiers

CVE-2023-22389

Affected Products

Snap One Wattbox Wb-300-Ip-3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-22389 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22389 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-03 · Note
• https://t.me/cibsecurity/57184 · Telegram Post
• https://t.me/cvenotify/43153 · Telegram Post
• https://t.me/cvenotify/43774 · Telegram Post