PT-2023-2368 · Delta Electronics · Infrasuite Device Master
Chudypd
+1
·
Publicado
2023-03-21
·
Atualizado
2023-05-17
·
CVE-2023-1142
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Delta Electronics InfraSuite Device Master versions prior to 1.0.5
Description
The issue allows an attacker to retrieve system files, credentials, and bypass authentication, resulting in privilege escalation. This can be achieved through URL decoding. Additionally, the vulnerability is related to the restoration of unreliable data in memory, which can be exploited by a remote attacker to execute arbitrary code using specially crafted UDP packets.
Recommendations
For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to sensitive system files and credentials to minimize the risk of exploitation.
Avoid using URL decoding to retrieve system files until the issue is resolved.
Correção
Deserialization of Untrusted Data
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Infrasuite Device Master