Opto 22
Products
2- 5 CVEs
- 1 CVE
Recent CVEs
6| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-13084 | Hig | 0.49 | 7.6 | 0.00 | Nov 26, 2025 | The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators. | |
| CVE-2023-40710 | 0.00 | — | 0.00 | Aug 24, 2023 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b | ||
| CVE-2023-40709 | 0.00 | — | 0.00 | Aug 24, 2023 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b | ||
| CVE-2023-40708 | 0.00 | — | 0.00 | Aug 24, 2023 | The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. | ||
| CVE-2023-40707 | 0.00 | — | 0.00 | Aug 24, 2023 | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. | ||
| CVE-2023-40706 | 0.00 | — | 0.00 | Aug 24, 2023 | There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login. |
- risk 0.49cvss 7.6epss 0.00
The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
- CVE-2023-40710Aug 24, 2023risk 0.00cvss —epss 0.00
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- CVE-2023-40709Aug 24, 2023risk 0.00cvss —epss 0.00
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- CVE-2023-40708Aug 24, 2023risk 0.00cvss —epss 0.00
The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.
- CVE-2023-40707Aug 24, 2023risk 0.00cvss —epss 0.00
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.
- CVE-2023-40706Aug 24, 2023risk 0.00cvss —epss 0.00
There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.