PT-2023-7416 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Publicado 2023-11-28 · Atualizado 2023-12-11 · CVE-2023-39226

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description The issue is related to the use of dangerous methods or functions in the software, allowing a remote attacker to execute arbitrary code by sending a specially crafted UDP packet. This can be achieved through a single UDP packet, enabling an unauthenticated attacker to perform the exploit.

Recommendations For Delta Electronics InfraSuite Device Master version 1.0.7, consider disabling the vulnerable function or restricting access to the affected module until a patch is available. As a temporary workaround, avoid using the RunScript function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-749

Identificadores relacionados

BDU:2023-08453

CVE-2023-39226

ZDI-23-1755

Produtos afetados

Infrasuite Device Master

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-39226 · Nota de Segurança
• https://t.me/cvenotify/62537 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Nota
• https://t.me/cvenotify/61825 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1755 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08453 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39226 · Aviso do Fabricante
• https://t.me/true_secator/5187 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-CAN-21859 · Nota