PT-2023-2188 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Publicado 2023-03-21 · Atualizado 2023-05-17 · CVE-2023-1145

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue is related to a deserialization vulnerability in the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution. This vulnerability is associated with shortcomings in the deserialization mechanism, allowing an attacker to execute arbitrary code by sending specially crafted requests.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Device-DataCollect service to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2023-01933

CVE-2023-1145

ZDI-23-681

Produtos afetados

Infrasuite Device Master

Referências · 7

• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1145 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01933 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1145 · Aviso do Fabricante
• https://t.me/cibsecurity/60790 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-681 · Nota de Segurança
• https://t.me/true_secator/4205 · Publicação no Telegram