CVE-2023-40708

Improper Access Control in OPTO 22 SNAP PAC S1

Medium5.8EPSS 0.48%

Published: 24 Aug 2023
Updated: 2 Oct 2024
Reserved: 18 Aug 2023
Assigned by: Dragos

Description

The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.

Scores

CVSS scores of CVE-2023-40708, by who scored it
Scored by	CVSS	Score	Vector
DragosCNA (assigner)	3.1	Medium5.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 0.48% · top 59% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Weakness

CWE-1188 Insecure Default Initialization of Resource (opens in a new tab)All about CWE-1188 and its CVEs

Affected products

OPTO 22 · SNAP PAC S1
- affected R10.3b

References (1)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-40708](https://trackcve.app/badge/CVE-2023-40708.svg)](https://trackcve.app/cve/CVE-2023-40708)

Record last updated 2 Oct 2024, 20:20 UTC.