CVE-2023-28649

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.

• CWE-413
• CWE-20

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01Third Party Advisory, US Government Resource
• https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdfRelease Notes
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01Third Party Advisory, US Government Resource
• https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdfRelease Notes

Published

May 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28643Nextcloud server is an open source home cloud implementation…8.8
• CVE-2023-28644Nextcloud server is an open source home cloud implementation…7.5
• CVE-2023-28645Nextcloud richdocuments is a Nextcloud app integrating the o…6.5
• CVE-2023-28646Nextcloud android is an android app for interfacing with the…2.4
• CVE-2023-28647Nextcloud iOS is an ios application used to interface with t…6.8
• CVE-2023-28648Osprey Pump Controller version 1.01 inputs passed to a GET p…6.1
• CVE-2023-2865A vulnerability was found in SourceCodester Theme Park Ticke…9.8
• CVE-2023-28650An unauthenticated remote attacker could provide a malicious…6.1
• CVE-2023-28651Cross-site scripting vulnerability exists in CONPROSYS HMI S…4.8
• CVE-2023-28652An authenticated malicious user could successfully upload a …6.5
• CVE-2023-28653 The affected application lacks proper valid…7.8
• CVE-2023-28654Osprey Pump Controller version 1.01 has a hidden administrat…9.8