CVE-2023-40707 - OpenCVE

There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opto22	Snap Pac S1 Snap Pac S1 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:opto22:snap_pac_s1_firmware:r10.3b:*:*:*:*:*:*:*

cpe:2.3:h:opto22:snap_pac_s1:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: Dragos

Published: 2023-08-24T16:05:48.352Z

Updated: 2024-08-02T18:38:51.159Z

Reserved: 2023-08-18T19:31:53.417Z

Link: CVE-2023-40707

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-08-24T17:15:08.967

Modified: 2023-08-29T23:34:10.753

Link: CVE-2023-40707

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40707", "assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef", "state": "PUBLISHED", "assignerShortName": "Dragos", "dateReserved": "2023-08-18T19:31:53.417Z", "datePublished": "2023-08-24T16:05:48.352Z", "dateUpdated": "2024-08-02T18:38:51.159Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SNAP PAC S1", "vendor": "OPTO 22", "versions": [{"status": "affected", "version": "R10.3b"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nicolas Cano"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials."}], "value": "There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-521", "description": "CWE-521 Weak Password Requirements", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef", "shortName": "Dragos", "dateUpdated": "2023-08-24T16:05:48.352Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02"}], "source": {"discovery": "UNKNOWN"}, "title": "Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:38:51.159Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02", "tags": ["x_transferred"]}]}]}}