Skip to main content

Orvc CVE-2023-31240

CRITICAL
Use of Weak Credentials (CWE-1391)
2023-05-22 ics-cert@hq.dhs.gov
Information Disclosure Orvc
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 22, 2023 - 20:15 nvd
CRITICAL 9.8

DescriptionNVD

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.

AnalysisAI

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1391. Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials. Affected products include: Snapone Orvc. Version information: prior to 7.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Orvc

View all
CVE-2023-31241 CRITICAL
10.0 May 22

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. Rated
CVE-2023-28386 CRITICAL
9.8 May 22

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. Rated critical severity (CV
CVE-2023-31193 HIGH
7.5 May 22

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Rated high s
CVE-2023-28649 HIGH
7.5 May 22

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. Ra
CVE-2023-25183 HIGH
7.2 May 22

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that cou
CVE-2023-31245 MEDIUM
6.1 May 22

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conne
CVE-2023-28412 MEDIUM
5.3 May 22

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. Rated med

Same weakness CWE-1391 – Use of Weak Credentials

View all
CVE-2024-51978 CRITICAL POC
9.8
CVE-2025-52364 HIGH POC
7.5
CVE-2026-22886 CRITICAL
9.8
CVE-2025-67114 CRITICAL
9.8
CVE-2024-12728 CRITICAL
9.8
CVE-2023-0635 CRITICAL
9.8
CVE-2026-8076 CRITICAL
9.3
CVE-2024-43698 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-31240 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy