CVE-2023-28386 – This vulnerability allows attackers to upload m... (How to Fix)

Q: What is the severity of CVE-2023-28386?

CVE-2023-28386 has a CVSS score of 8.6 (HIGH). This vulnerability allows attackers to upload malicious firmware to Snap One OvrC Pro devices due to insufficient signature validation. Only MD5 hash checking is performed instead of proper PKI-based verification. All users of OvrC Pro devices versions 7.2 and prior are affected.

📋 TL;DR

This vulnerability allows attackers to upload malicious firmware to Snap One OvrC Pro devices due to insufficient signature validation. Only MD5 hash checking is performed instead of proper PKI-based verification. All users of OvrC Pro devices versions 7.2 and prior are affected.

💻 Affected Systems

Products:

Snap One OvrC Pro

Versions: 7.2 and prior

Operating Systems: Embedded/Linux-based firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All devices running affected firmware versions are vulnerable regardless of configuration.

📦 What is this software?

Orvc by Snapone

View all CVEs affecting Orvc →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise allowing persistent remote code execution, data exfiltration, and lateral movement within networks.

🟠

Likely Case

Unauthorized firmware installation leading to device malfunction, data interception, or use as attack platform.

🟢

If Mitigated

No impact if proper firmware signature validation is implemented and enforced.

🌐 Internet-Facing: HIGH - Devices exposed to internet can be directly targeted for firmware manipulation.

🏢 Internal Only: MEDIUM - Requires network access but could be exploited by malicious insiders or compromised internal systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires network access to device but no authentication. Attack involves crafting malicious firmware with matching MD5 hash.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 7.2

Vendor Advisory: https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf

Restart Required: Yes

Instructions:

1. Access OvrC Pro web interface. 2. Navigate to System > Firmware Update. 3. Download and install latest firmware version. 4. Reboot device after installation completes.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate OvrC Pro devices from untrusted networks and internet access.

Firewall Rules

all

Block firmware update endpoints from external access.

🧯 If You Can't Patch

Physically disconnect devices from networks when not in use
Implement strict network monitoring for firmware update attempts

🔍 How to Verify

Check if Vulnerable:

Check firmware version in OvrC Pro web interface under System > About. If version is 7.2 or lower, device is vulnerable.

Check Version:

curl -k https://[device-ip]/api/v1/system/info | grep version

Verify Fix Applied:

Confirm firmware version is higher than 7.2 and verify firmware signature validation is enabled in security settings.

📡 Detection & Monitoring

Log Indicators:

Unexpected firmware update events
MD5 hash mismatch warnings
Unauthorized firmware upload attempts

Network Indicators:

HTTP POST requests to firmware update endpoints
Unusual outbound connections after firmware update

SIEM Query:

source="ovrc" AND (event="firmware_update" OR event="firmware_upload")

📊 Metadata

CVE ID: CVE-2023-28386

CVSS v3 Score: 8.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE: CWE-354

Published: May 22, 2023

Last Updated: December 9, 2024

🔗 References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 Third Party Advisory,US Government Resource
https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf Release Notes
https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 Third Party Advisory,US Government Resource
https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf Release Notes

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-28386, you might also want to check these: