CVE-2024-50381CWE-306

Missing Authentication for Critical Function in Snap One OVRC cloud

High · published December 2, 2024

CVSS v4.0
8.8
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a request to claim it.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-12-02T16:34Z
EPSS history
Timeline
  • 02 DEC 16:34Z
    Missing Authentication for Critical Function in Snap One OVRC cloud
    cvelistv5