PT-2022-25280 · Delta Electronics · Infrasuite Device Master

Chudypb + 1 · Published 2022-10-27 · Updated 2023-01-18 · CVE-2022-40202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions 00.00.01a and prior

Description The database backup function in the software lacks proper authentication, allowing an attacker to provide malicious serialized objects. When deserialized, these objects could activate an opcode for a backup scheduling function without authentication. This function enables the attacker to designate all function arguments and the file to be executed, potentially allowing them to start any new process and achieve remote code execution.

Recommendations For versions 00.00.01a and prior, consider disabling the backup scheduling function until a patch is available to prevent potential remote code execution. Restrict access to the ExeCommandInCommandLineMode to minimize the risk of exploitation. Avoid using the function arguments and file execution features in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-40202

ZDI-22-1484

ZDI-23-083

Affected Products

Infrasuite Device Master

References · 5

• https://zerodayinitiative.com/advisories/ZDI-23-083 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40202 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-298-07 · Patch
• https://osv.dev/vulnerability/CVE-2022-40202 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1484 · Security Note