CVE-2023-28386

CVE-2023-28386 is a critical vulnerability affecting Snap One OvrC Pro devices running versions 7.2 and prior, stemming from insufficient firmware update validation. The devices only perform an MD5 hash check, lacking a robust public-key infrastructure (PKI) for signature verification. This flaw allows unauthenticated attackers to upload arbitrary malicious firmware, leading to remote code execution with full compromise of the device. While no active exploitation or public exploit code has been identified, the vulnerability has garnered significant community discussion, indicating potential interest.