PT-2023-2322 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Publicado 2023-03-21 · Atualizado 2023-05-17 · CVE-2023-1138

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue is related to improper access control, which could allow an attacker to retrieve Gateway configuration files and obtain plaintext credentials. This could enable unauthorized access to sensitive information.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gateway configuration files to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-02087

CVE-2023-1138

ZDI-23-673

Produtos afetados

Infrasuite Device Master

Referências · 6

• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Nota
• https://zerodayinitiative.com/advisories/ZDI-23-673 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-1138 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1138 · Aviso do Fabricante
• https://t.me/cibsecurity/60785 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02087 · Nota de Segurança