CVE-2023-40706

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
OPTO 22	SNAP PAC S1	R10.3b
opto22	snap_pac_s1	r10.3b

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02Third Party Advisory, US Government Resource

Timeline

Published: Aug 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-407077.5There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could CVE-2023-407085.3The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access CVE-2023-407097.5An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enable CVE-2023-40718.8Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption vi CVE-2023-407107.5An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller h CVE-2023-407117.5Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attacker CVE-2023-407126.5Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in CVE-2023-407148.8A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to es CVE-2023-407155.5A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to CVE-2023-407167.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester CVE-2023-407177.8A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell CVE-2023-407187.5A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packe