Skip to main content

Orvc CVE-2023-31241

CRITICAL
Unprotected Alternate Channel (CWE-420)
2023-05-22 ics-cert@hq.dhs.gov
Authentication Bypass Orvc
10.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 22, 2023 - 20:15 nvd
CRITICAL 10.0

DescriptionNVD

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.

AnalysisAI

Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-420. Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. Affected products include: Snapone Orvc.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Orvc

View all
CVE-2023-31240 CRITICAL
9.8 May 22

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network
CVE-2023-28386 CRITICAL
9.8 May 22

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. Rated critical severity (CV
CVE-2023-31193 HIGH
7.5 May 22

Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Rated high s
CVE-2023-28649 HIGH
7.5 May 22

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. Ra
CVE-2023-25183 HIGH
7.2 May 22

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that cou
CVE-2023-31245 MEDIUM
6.1 May 22

Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conne
CVE-2023-28412 MEDIUM
5.3 May 22

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. Rated med

Same weakness CWE-420 – Unprotected Alternate Channel

View all
CVE-2025-13315 CRITICAL POC
9.3
CVE-2023-20198 CRITICAL POC
10.0
CVE-2026-40217 HIGH POC
8.8
CVE-2020-8558 HIGH POC
8.8
CVE-2023-28840 HIGH POC
8.7
CVE-2025-67303 HIGH POC
7.5
CVE-2025-52921 CRITICAL
9.9
CVE-2024-4444 MEDIUM POC
5.3

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-31241 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy