PT-2023-7702 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Publicado 2023-11-28 · Atualizado 2023-12-11 · CVE-2023-47207

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description The issue is related to the deserialization of untrusted data, which can lead to remote code execution. An unauthenticated attacker can exploit this to execute code with local administrator privileges. This can potentially allow a remote attacker to gain elevated access to the system.

Recommendations For Delta Electronics InfraSuite Device Master version 1.0.7, consider restricting access to the Device-DataCollect and Device-Gateway components until a patch is available. As a temporary workaround, disabling the deserialization of untrusted data may help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2023-08769

CVE-2023-47207

ZDI-23-1753

ZDI-23-1754

Produtos afetados

Infrasuite Device Master

Referências · 10

• https://t.me/cvenotify/62567 · Publicação no Telegram
• https://t.me/cvenotify/61827 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Nota
• https://bdu.fstec.ru/vul/2023-08769 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-47207 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-CAN-21771 · Nota
• https://zerodayinitiative.com/advisories/ZDI-23-1754 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-47207 · Aviso do Fabricante
• https://t.me/true_secator/5187 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1753 · Nota de Segurança