PT-2023-2346 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Publicado 2023-03-21 · Atualizado 2023-05-17 · CVE-2023-1136

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue is related to insufficient input validation in the Delta Electronics InfraSuite Device Master software, which could allow an unauthenticated attacker to generate a valid token. This token generation could lead to authentication bypass, potentially enabling a remote attacker to elevate their privileges.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the authentication mechanism until a patch is available.

Correção

Incorrect Authorization

Improper Authentication

Enumeração de Fraquezas

CWE-863

CWE-287

Identificadores relacionados

BDU:2023-02111

CVE-2023-1136

ZDI-23-679

Produtos afetados

Infrasuite Device Master

Referências · 6

• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Nota
• https://bdu.fstec.ru/vul/2023-02111 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-1136 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-679 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1136 · Aviso do Fabricante
• https://t.me/cibsecurity/60786 · Publicação no Telegram