Auth bypass in Snap One Ovrc Cloud
CVE-2024-50381
A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a request to claim it.
Vulnerability class: Broken Authentication
EPSS: 0.005 (42.4th percentile) — read the EPSS interpretation.
Affected products
- Snap One Ovrc Cloud — versions 0
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (government-resource)