PT-2023-7641 · Delta Electronics · Infrasuite Device Master

Hir0Ot + 1 · Publicado 2023-11-28 · Atualizado 2023-12-11 · CVE-2023-46690

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description A vulnerability exists in Delta Electronics InfraSuite Device Master that allows an attacker to write to any file in any location of the filesystem, potentially leading to remote code execution. This issue arises due to incorrect restriction of the directory path name with limited access. The exploitation of this vulnerability could enable a remote attacker to execute arbitrary code.

Recommendations For version 1.0.7, update to a newer version that contains a fix for this issue, as the current version allows for directory traversal and remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-35

CWE-22

Identificadores relacionados

BDU:2023-08702

CVE-2023-46690

ZDI-23-1752

Produtos afetados

Infrasuite Device Master

Referências · 9

• https://osv.dev/vulnerability/CVE-2023-46690 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-CAN-21707 · Nota
• https://bdu.fstec.ru/vul/2023-08702 · Nota de Segurança
• https://t.me/cvenotify/61826 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Nota
• https://t.me/true_secator/5187 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46690 · Nota de Segurança
• https://t.me/cvenotify/62566 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1752 · Nota de Segurança