CVE-2023-28386
22.05.2023, 20:15
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution.Enginsight
| Vendor | Product | Version |
|---|---|---|
| snapone | orvc | 𝑥 < 7.3.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-354 - Improper Validation of Integrity Check ValueThe software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References