PT-2023-19964 · Snap One · Ovrc Pro

Uri Katz · Published 2023-05-22 · Updated 2023-05-31 · CVE-2023-25183

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Snap One OvrC Pro versions prior to 7.2

Description The issue allows users to execute arbitrary commands on the hub device when logged into the superuser account, due to a new functionality that appears in affected versions.

Recommendations For versions prior to 7.2, update to version 7.2 or later to resolve the issue.

Fix

Hidden Functionality

Weakness Enumeration

CWE-912

Related Identifiers

CVE-2023-25183

Affected Products

Ovrc Pro

References · 5

• https://osv.dev/vulnerability/CVE-2023-25183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25183 · Security Note
• https://control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-136-01 · Note
• https://t.me/cibsecurity/64577 · Telegram Post