description:
When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.
problem types: CWE-204 Observable Response Discrepancy
affected:
{
defaultStatus: unaffected
product: OvrC Cloud
vendor: Snap One
versions:
lessThan: 7.3, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Snap One has released the following updates/fixes for the affected products:
*  OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.
*  OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.
*  Disable UPnP.
For more information, see Snap One’s  Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf .