Skip to main content

Orvc CVE-2023-28412

MEDIUM
Observable Response Discrepancy (CWE-204)
2023-05-22 ics-cert@hq.dhs.gov
Information Disclosure Orvc
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 22, 2023 - 20:15 nvd
MEDIUM 5.3

DescriptionNVD

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.

AnalysisAI

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-204. When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information. Affected products include: Snapone Orvc.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Orvc

View all
CVE-2023-31241 CRITICAL
10.0 May 22

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. Rated
CVE-2023-31240 CRITICAL
9.8 May 22

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network
CVE-2023-28386 CRITICAL
9.8 May 22

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. Rated critical severity (CV
CVE-2023-31193 HIGH
7.5 May 22

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Rated high s
CVE-2023-28649 HIGH
7.5 May 22

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. Ra
CVE-2023-25183 HIGH
7.2 May 22

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that cou
CVE-2023-31245 MEDIUM
6.1 May 22

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conne

Same weakness CWE-204 – Observable Response Discrepancy

View all
CVE-2018-25350 CRITICAL POC
9.3
CVE-2024-28232 HIGH POC
7.5
CVE-2024-24766 HIGH POC
7.5
CVE-2025-66307 MEDIUM POC
6.5
CVE-2024-6056 MEDIUM POC
6.3
CVE-2025-30150 MEDIUM POC
5.5
CVE-2024-55198 MEDIUM POC
5.3
CVE-2025-65899 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-28412 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy