CVE-2023-40707

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
OPTO 22	SNAP PAC S1	R10.3b
opto22	snap_pac_s1	r10.3b

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02Third Party Advisory, US Government Resource

Timeline

Published: Aug 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-407085.3The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access CVE-2023-407097.5An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enable CVE-2023-40718.8Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption vi CVE-2023-407107.5An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller h CVE-2023-407117.5Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attacker CVE-2023-407126.5Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in CVE-2023-407148.8A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to es CVE-2023-407155.5A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to CVE-2023-407167.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester CVE-2023-407177.8A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell CVE-2023-407187.5A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packe CVE-2023-407195.5A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an at