PT-2022-19784 · Delta Industrial Automation · Dialink

4Er · Published 2022-12-01 · Updated 2023-05-17 · CVE-2022-2969

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4

Description The issue arises from the software's failure to properly neutralize special elements within a pathname constructed from external input. This pathname is intended to identify a file or directory located underneath a restricted parent directory. However, due to the lack of proper neutralization, the pathname can resolve to a location outside of the restricted directory, potentially leading to unauthorized access or file creation.

Recommendations For versions prior to v1.5.0.0 Beta 4, update to version v1.5.0.0 Beta 4 or later to resolve the issue. As a temporary workaround, consider restricting external input to prevent the construction of malicious pathnames until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-2969

ZDI-23-671

Affected Products

Dialink

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-2969 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-671 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2969 · Vendor Advisory
• https://t.me/cibsecurity/53776 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-03 · Note