PT-2022-26009 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Published 2022-10-27 · Updated 2023-01-18 · CVE-2022-41657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 00.00.01a and prior

Description The issue allows an attacker to use provided data already serialized into memory for file operations through application programmable interfaces (APIs). This could lead to the creation of arbitrary files, which could be used in API operations and potentially result in remote code execution.

Recommendations For Delta Electronics InfraSuite Device Master version 00.00.01a and prior, consider disabling the CtrlLayerNWCmd FileOperation function until a patch is available to prevent directory traversal and remote code execution. Restrict access to the vulnerable CtrlLayerNWCmd FileOperation module to minimize the risk of exploitation. Avoid using the Opcode 512 in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41657

ZDI-22-1477

ZDI-22-1479

ZDI-22-1481

ZDI-22-1482

ZDI-23-082

ZDI-23-084

ZDI-23-085

ZDI-23-086

Affected Products

Infrasuite Device Master

References · 12

• https://zerodayinitiative.com/advisories/ZDI-22-1481 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-084 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-086 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1479 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1482 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-085 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41657 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-298-07 · Patch
• https://zerodayinitiative.com/advisories/ZDI-22-1477 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-082 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41657 · Vendor Advisory
• https://t.me/cibsecurity/52316 · Telegram Post