Displaying items by tag: Uri Katz

GUEST RESEARCH:  

Executive Summary

• Team82 has researched the security of the OvrC cloud platform, which is used by businesses and consumers to remotely manage IoT devices.
• We uncovered 10 different vulnerabilities that, when chained, allow attackers to execute code on OvrC cloud-connected devices, remotely over the cloud.
• OvrC Pro and OvrC Connect are affected; updates were released in May 2023 via ICSA-23-136-01 for eight vulnerabilities, and the two remaining issues were addressed in an update announced today: CISA's advisory is here.
• Attackers successfully exploiting these vulnerabilities can access, control, and disrupt devices supported by OvrC; some of those include smart electrical power supplies, cameras, routers, home automation systems, and more.
• We appreciate and thank SnapOne and CISA for coordinating the disclosure.