PT-2023-21687 · Snap One · Ovrc Pro

Uri Katz · Published 2023-05-22 · Updated 2024-12-09 · CVE-2023-28386

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snap One OvrC Pro devices versions 7.2 and prior

Description The issue arises from the device's failure to properly validate firmware updates, relying solely on the calculation of the MD5 hash of the firmware without utilizing a private-public key mechanism. This lack of a complete PKI system for firmware signature verification could allow attackers to upload arbitrary firmware updates, resulting in code execution.

Recommendations For versions 7.2 and prior, consider disabling firmware updates until a patch is available that implements a complete PKI system for firmware signature verification. Restrict access to the firmware update mechanism to minimize the risk of exploitation. Avoid using the MD5 hash as the sole means of verifying firmware updates. Update to a version that includes a fix for this issue when available.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-354

Related Identifiers

CVE-2023-28386

Affected Products

Ovrc Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28386 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28386 · Vendor Advisory
• https://t.me/true_secator/6430 · Telegram Post
• https://t.me/cvenotify/103587 · Telegram Post
• https://t.me/cibsecurity/64572 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-136-01 · Note
• https://control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf · Note