Multiple vulnerabilities in Delta Electronics InfraSuite Device Master



Published: 2022-10-26 | Updated: 2023-02-01
Risk High
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2022-41778
CVE-2022-38142
CVE-2022-41779
CVE-2022-41657
CVE-2022-41772
CVE-2022-40202
CVE-2022-41688
CVE-2022-41644
CVE-2022-41776
CVE-2022-41629
CWE-ID CWE-502
CWE-22
CWE-306
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
InfraSuite Device Master
Other software / Other software solutions

Vendor Delta Electronics, Inc.

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Deserialization of Untrusted Data

EUVDB-ID: #VU68751

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41778

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the Device-DataCollect service port. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Deserialization of Untrusted Data

EUVDB-ID: #VU68752

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-38142

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the Device-Gateway service port. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Deserialization of Untrusted Data

EUVDB-ID: #VU68753

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41779

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Path traversal

EUVDB-ID: #VU68754

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41657

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the CtrlLayerNWCmd_FileOperation function. A remote attacker can send a specially crafted HTTP request and create arbitrary files on the system, leading to arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07
http://www.zerodayinitiative.com/advisories/ZDI-23-086/
http://www.zerodayinitiative.com/advisories/ZDI-23-085/
http://www.zerodayinitiative.com/advisories/ZDI-23-084/
http://www.zerodayinitiative.com/advisories/ZDI-23-082/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Path traversal

EUVDB-ID: #VU68755

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41772

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and execute arbitrary code on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Missing Authentication for Critical Function

EUVDB-ID: #VU68756

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40202

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the database backup function lacks proper authentication within the ExeCommandInCommandLineMode function. A remote attacker can start any new process and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07
http://www.zerodayinitiative.com/advisories/ZDI-23-083/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Missing Authentication for Critical Function

EUVDB-ID: #VU68757

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41688

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication for functions that create and modify user groups. A remote attacker can create a new user and add them to the administrator group.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Missing Authentication for Critical Function

EUVDB-ID: #VU68758

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41644

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication for a function that changes group privileges. A remote user can create a denial of service state or escalate their own privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Missing Authentication for Critical Function

EUVDB-ID: #VU68759

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41776

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper authentication within the WriteConfiguration method. A remote attacker can provide new values for user configuration files and change the administrative passwords.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Missing Authentication for Critical Function

EUVDB-ID: #VU68760

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41629

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper access to the aprunning endpoint. A remote attacker can retrieve any file from the "RunningConfigs" directory and see existing administrative passwords.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

InfraSuite Device Master: 00.00.01a

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-298-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###