CVE-2023-31245 : Devices using Snap One OvrC cloud are sent to a web address when accessing a web

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attackers could impersonate a device and supply malicious information about the device’s web server interface. By supplying malicious parameters, an attacker could redirect the user to arbitrary and dangerous locations on the web.

Published 2023-05-22 20:15:11

Updated 2023-05-31 15:23:26

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Open redirect

Products affected by CVE-2023-31245

Snapone » Orvc » For PRO
Versions before (<) 7.3.0
cpe:2.3:a:snapone:orvc:*:*:*:*:*:pro:*:*
Matching versions
When used together with: Control4 » Ca-1 » Version: N/A
When used together with: Control4 » Ca-10 » Version: N/A
When used together with: Control4 » Ea-1 » Version: N/A
When used together with: Control4 » Ea-3 » Version: N/A
When used together with: Control4 » Ea-5 » Version: N/A
When used together with: Snapone » An-110-rt-2l1w » Version: N/A
When used together with: Snapone » An-110-rt-2l1w-wifi » Version: N/A
When used together with: Snapone » An-310-rt-4l2w » Version: N/A
When used together with: Snapone » Ovrc-300-pro » Version: N/A
When used together with: Snapone » Pakedge Rk-1 » Version: N/A
When used together with: Snapone » Pakedge Rt-3100 » Version: N/A
When used together with: Snapone » Pakedge Wr-1 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-31245

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-31245

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	2.8	3.7	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: Low
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-31245

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Assigned by: ics-cert@hq.dhs.gov (Primary)

References for CVE-2023-31245

https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf

Release Notes

CVEs referencing this url
https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01

Snap One OvrC Cloud | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-31245

Products affected by CVE-2023-31245

Exploit prediction scoring system (EPSS) score for CVE-2023-31245

CVSS scores for CVE-2023-31245

CWE ids for CVE-2023-31245

References for CVE-2023-31245