opto22 CVE Vulnerabilities & Metrics

Focus on opto22 vulnerabilities and metrics.

Last updated: 08 May 2025, 22:25 UTC

About opto22 Security Exposure

This page consolidates all known Common Vulnerabilities and Exposures (CVEs) associated with opto22. We track both calendar-based metrics (using fixed periods) and rolling metrics (using gliding windows) to give you a comprehensive view of security trends and risk evolution. Use these insights to assess risk and plan your patching strategy.

For a broader perspective on cybersecurity threats, explore the comprehensive list of CVEs by vendor and product. Stay updated on critical vulnerabilities affecting major software and hardware providers.

Global CVE Overview

Total opto22 CVEs: 12
Earliest CVE date: 18 Oct 2018, 21:29 UTC
Latest CVE date: 24 Aug 2023, 17:15 UTC

Latest CVE reference: CVE-2023-40710

Rolling Stats

30-day Count (Rolling): 0
365-day Count (Rolling): 0

Calendar-based Variation

Calendar-based Variation compares a fixed calendar period (e.g., this month versus the same month last year), while Rolling Growth Rate uses a continuous window (e.g., last 30 days versus the previous 30 days) to capture trends independent of calendar boundaries.

Variations & Growth

Month Variation (Calendar): 0%
Year Variation (Calendar): -100.0%

Month Growth Rate (30-day Rolling): 0.0%
Year Growth Rate (365-day Rolling): -100.0%

Monthly CVE Trends (current vs previous Year)

Annual CVE Trends (Last 20 Years)

Critical opto22 CVEs (CVSS ≥ 9) Over 20 Years

CVSS Stats

Average CVSS: 3.75

Max CVSS: 9.3

Critical CVEs (≥9): 1

CVSS Range vs. Count

Range Count
0.0-3.9 6
4.0-6.9 3
7.0-8.9 2
9.0-10.0 1

CVSS Distribution Chart

Top 5 Highest CVSS opto22 CVEs

These are the five CVEs with the highest CVSS scores for opto22, sorted by severity first and recency.

All CVEs for opto22

CVE-2023-40710 opto22 vulnerability CVSS: 0 24 Aug 2023, 17:15 UTC

An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b

CVE-2023-40709 opto22 vulnerability CVSS: 0 24 Aug 2023, 17:15 UTC

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b

CVE-2023-40708 opto22 vulnerability CVSS: 0 24 Aug 2023, 17:15 UTC

The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.

CVE-2023-40707 opto22 vulnerability CVSS: 0 24 Aug 2023, 17:15 UTC

There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.

CVE-2023-40706 opto22 vulnerability CVSS: 0 24 Aug 2023, 17:15 UTC

There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.

CVE-2020-12046 opto22 vulnerability CVSS: 3.5 14 May 2020, 21:15 UTC

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware update. This allows an attacker to replace legitimate firmware files with malicious files.

CVE-2020-12042 opto22 vulnerability CVSS: 4.0 14 May 2020, 21:15 UTC

Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware are not sanitized. As a result, an attacker with user privileges can gain arbitrary file write access with system access.

CVE-2020-10620 opto22 vulnerability CVSS: 7.5 14 May 2020, 21:15 UTC

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly communicate with SoftPAC, including, for example, stopping the service remotely.

CVE-2020-10616 opto22 vulnerability CVSS: 6.8 14 May 2020, 21:15 UTC

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and execute code whenever the service starts.

CVE-2020-10612 opto22 vulnerability CVSS: 6.4 14 May 2020, 21:15 UTC

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting or stopping service, or writing to certain registry values.

CVE-2015-1007 opto22 vulnerability CVSS: 9.3 25 Mar 2019, 19:29 UTC

A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.

CVE-2018-14807 opto22 vulnerability CVSS: 7.5 18 Oct 2018, 21:29 UTC

A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.