PT-2023-2085 · Delta Electronics · Infrasuite Device Master
Chudypd
+1
·
Publicado
2023-03-21
·
Atualizado
2023-06-08
·
CVE-2023-1133
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Delta Electronics InfraSuite Device Master versions prior to 1.0.5
Description
The issue is related to the Device-status service listening on port 10100/UDP by default, accepting unverified UDP packets, and deserializing their content. This could allow an unauthenticated attacker to remotely execute arbitrary code. The vulnerability is associated with the deserialization of untrusted data, which may enable a remote attacker to execute arbitrary code using specially crafted UDP packets.
Recommendations
For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10100/UDP to minimize the risk of exploitation. Additionally, disabling the Device-status service until a patch is applied may also help mitigate the risk.
Exploit
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Infrasuite Device Master