description:
Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attackers could impersonate a device and supply malicious information about the device’s web server interface. By supplying malicious parameters, an attacker could redirect the user to arbitrary and dangerous locations on the web.
problem types: CWE-601 Open Redirect
affected:
{
defaultStatus: unaffected
product: OvrC Cloud
vendor: Snap One
versions:
lessThan: 7.3, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Snap One has released the following updates/fixes for the affected products:
*  OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.
*  OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.
*  Disable UPnP.
For more information, see Snap One’s  Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .