PT-2023-2321 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Publicado 2023-03-21 · Atualizado 2023-05-17 · CVE-2023-1141

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue is related to a command injection vulnerability that could allow an attacker to inject arbitrary commands, potentially resulting in remote code execution. The vulnerability is associated with inadequate data cleaning measures at the management level, which could be exploited by a remote attacker to execute arbitrary code.

Recommendations For Delta Electronics InfraSuite Device Master versions prior to 1.0.5, update to version 1.0.5 or later to resolve the command injection vulnerability. As a temporary workaround, consider restricting access to the command line interface to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-02086

CVE-2023-1141

ZDI-23-684

Produtos afetados

Infrasuite Device Master

Referências · 5

• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Nota
• https://zerodayinitiative.com/advisories/ZDI-23-684 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-1141 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1141 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02086 · Nota de Segurança