PT-2022-25993 · Delta Electronics · Infrasuite Device Master

Kimiya · Published 2022-10-27 · Updated 2022-11-02 · CVE-2022-41629

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions 00.00.01a and prior

Description The issue allows unauthenticated users to access the "aprunning" endpoint, potentially enabling an attacker to retrieve any file from the “RunningConfigs” directory. This could lead to the viewing and modification of configuration files, such as UserListInfo.xml, which contains existing administrative passwords.

Recommendations For Delta Electronics InfraSuite Device Master versions 00.00.01a and prior, consider restricting access to the "aprunning" endpoint as a temporary workaround until a patch is available. Additionally, limit access to the “RunningConfigs” directory and sensitive files like UserListInfo.xml to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-41629

ZDI-22-1488

Affected Products

Infrasuite Device Master

References · 4

• https://osv.dev/vulnerability/CVE-2022-41629 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-298-07 · Patch
• https://zerodayinitiative.com/advisories/ZDI-22-1488 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41629 · Security Note