PT-2023-27605 · Opto 22 · Snap Pac S1 Firmware

Nicolas Cano · Published 2023-08-24 · Updated 2023-08-29 · CVE-2023-40707

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SNAP PAC S1 Firmware version R10.3b

Description The built-in web server of the SNAP PAC S1 Firmware does not require complex passwords, which could allow for a successful brute force attack if users do not set up complex credentials.

Recommendations For SNAP PAC S1 Firmware version R10.3b, consider setting up complex credentials to prevent brute force attacks. As a temporary workaround, restrict access to the built-in web server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2023-40707

Affected Products

Snap Pac S1 Firmware

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-40707 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40707 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-236-02 · Note
• https://t.me/cibsecurity/69127 · Telegram Post
• https://t.me/cvenotify/57192 · Telegram Post