CVE-2024-50380 HIGH

CVE-2024-50380: Authentication Bypass by Spoofing in Snap One OVRC cloud

Vendor Snap One

Product OVRC cloud

Weakness CWE-290

Published December 2, 2024

Last update December 2, 2024

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device.

Key dates

02Disclosure timeline

December 2, 2024 CVE published

December 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-50380 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/290.html

Related vulnerabilities

04Related CVE

CVE-2026-42674 WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability CVE-2026-33223 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField CVE-2026-53832 OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration CVE-2026-5792 Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC)