What is CVE-2023-28412?

CVE-2023-28412 is a medium-severity vulnerability in Control4 Ca-1, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2023-05-22.

How severe is CVE-2023-28412?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Control4 Ca-1

CVE-2023-28412

When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information. …

EPSS: 0.005 (37.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Control4 Ca-1
Control4 Ca-10
Control4 Ea-1
Control4 Ea-3
Control4 Ea-5
Snap One Ovrc Cloud — versions 0
Snapone An-110-rt-2l1w
Snapone An-110-rt-2l1w-wifi
Snapone An-310-rt-4l2w
Snapone Orvc

Weakness classification (CWE)

CWE-204 — Observable Response Discrepancy
CWE-203 — Observable Discrepancy

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory)
ics-cert@hq.dhs.gov (Release Notes)

Frequently asked questions

What is CVE-2023-28412?: CVE-2023-28412 is a medium-severity vulnerability in Control4 Ca-1, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2023-05-22.
How severe is CVE-2023-28412?: Medium severity. CVSS v3 base score is 5.3 out of 10.