CVE-2023-40708mediumCWE-1188

CVE-2023-40708: medium-severity vulnerability in OPTO 22 SNAP PAC S1

Improper Access Control in OPTO 22 SNAP PAC S1

Published · Updated

Follow this CVE+ Monitor SNAP PAC S1

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.8epss 0.5%
In short

The SNAP PAC S1 device leaves its FTP port open by default, which allows attackers to access files on the device without proper authorization. This can lead to information disclosure and compromise of the device.

Technical detail

CWE-1188 (Improper Access Control) vulnerability in SNAP PAC S1 R10.3b where FTP service is enabled by default without authentication restrictions. An adversary with network access to the FTP port can enumerate and retrieve sensitive device files, potentially leading to information disclosure and further attack surface exploration.

Summary generated and translated by AI from the official description.
The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products
OPTO 22 · SNAP PAC S1
Related CVEs — OPTO 22 SNAP PAC S1

In the same product, most dangerous first.

CVE-2023-40706HIGHImproper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web ServerEPSS 0.7%CVE-2023-40707HIGHWeak password requirements in OPTO 22 SNAP PAC S1 Built-in Web ServerEPSS 0.6%CVE-2023-40710MEDIUMCVE-2023-40710EPSS 0.6%CVE-2023-40709MEDIUMUncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web ServerEPSS 0.6%