CVE-2023-40708
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The FTP port is open by default in SNAP PAC S1 Firmware version R10.3b, which could allow unauthorized users to access some device files.
Risk Assessment
The open FTP port poses a risk of unauthorized access to sensitive data, potentially leading to security breaches.
Recommendation
It is recommended to close the FTP port or implement appropriate security measures to restrict access to the device.
Other vulnerabilities in SNAP PAC S1 Firmware version R10.3b
See all- CVE-2023-40710Medium
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40709Medium
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40707High
The built-in web server of SNAP PAC S1 Firmware version R10.3b does not require setting a complex password, which could allow for a successful brute force attack if users do not configure complex credentials.
- CVE-2023-40706High
The web server for SNAP PAC S1 Firmware version R10.3b has no limit on the number of login attempts. This could allow for a brute-force attack on the built-in web server login.
Original NVD description (English source)
The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS