PT-2022-26063 · Delta Electronics · Infrasuite Device Master

Kimiya · Published 2022-10-27 · Updated 2022-11-02 · CVE-2022-41772

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions 00.00.01a and prior

Description The issue concerns the mishandling of .ZIP archives containing characters used in path traversal, which could result in remote code execution. This path traversal vulnerability may lead to unauthorized access and control of the system.

Recommendations For versions 00.00.01a and prior, consider restricting access to the ZIP archive handling functionality until a patch is available. As a temporary workaround, avoid using .ZIP archives containing characters that could be used in path traversal attacks. Restrict access to sensitive directories and files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41772

ZDI-22-1483

Affected Products

Infrasuite Device Master

References · 5

• https://cisa.gov/uscert/ics/advisories/icsa-22-298-07 · Patch
• https://osv.dev/vulnerability/CVE-2022-41772 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41772 · Security Note
• https://t.me/cibsecurity/52315 · Telegram Post