Skip to main content

Orvc CVE-2023-31193

HIGH
Cleartext Transmission of Sensitive Information (CWE-319)
2023-05-22 ics-cert@hq.dhs.gov
Information Disclosure Orvc
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 22, 2023 - 20:15 nvd
HIGH 7.5

DescriptionNVD

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation.

AnalysisAI

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-319. Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation. Affected products include: Snapone Orvc. Version information: prior to 7.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Orvc

View all
CVE-2023-31241 CRITICAL
10.0 May 22

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. Rated
CVE-2023-31240 CRITICAL
9.8 May 22

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network
CVE-2023-28386 CRITICAL
9.8 May 22

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. Rated critical severity (CV
CVE-2023-28649 HIGH
7.5 May 22

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. Ra
CVE-2023-25183 HIGH
7.2 May 22

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that cou
CVE-2023-31245 MEDIUM
6.1 May 22

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conne
CVE-2023-28412 MEDIUM
5.3 May 22

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. Rated med

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all
CVE-2025-26199 CRITICAL POC
9.8
CVE-2025-32880 CRITICAL POC
9.8
CVE-2023-33730 CRITICAL POC
9.8
CVE-2019-15911 CRITICAL POC
9.8
CVE-2019-18852 CRITICAL POC
9.8
CVE-2024-25735 CRITICAL POC
9.1
CVE-2023-23914 CRITICAL POC
9.1
CVE-2024-50634 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-31193 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy