High ICSA-23-026-03 4 CVEs

Snap One Wattbox WB-300-IP-3

Published Jan 26, 2023 · Updated Jan 26, 2023

Vendor: Snap One Product: Wattbox WB-300-IP-3

Summary

Successful exploitation of these vulnerabilities could lead to remote code execution on the device, password brute force, and bricking of the device.

Vulnerabilities 4

High 7.5

CVE-2023-24020

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple at…

Snap One Wattbox WB-300-IP-3

Jan 30, 2023
Medium 6.7

CVE-2023-22315

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does…

Snap One Wattbox WB-300-IP-3

Jan 30, 2023
Medium 5.7

CVE-2023-22389

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configura…

Snap One Wattbox WB-300-IP-3

Jan 30, 2023
Medium 5.3

CVE-2023-23582

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could a…

Snap One Wattbox WB-300-IP-3

Jan 30, 2023

Revision history

2023-01-26 #1
Publication Date

References

ICS Advisory ICSA-23-026-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-026-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf