PT-2022-6253 · Delta Electronics · Delta Electronics Dvw-W02W2-E2

Thomas Weber · Published 2022-12-13 · Updated 2023-02-02 · CVE-2022-42139

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics DVW-W02W2-E2 version 1.5.0.10

Description The issue is related to a command injection vulnerability via crafted URLs in the web server of the Delta Electronics DVW-W02W2-E2 device. This vulnerability is due to the failure to neutralize special elements, which can allow a remote attacker to execute arbitrary commands and gain full control of the system by sending specially crafted requests.

Recommendations For Delta Electronics DVW-W02W2-E2 version 1.5.0.10, consider disabling access to the web server interface until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the device to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the command injection vulnerability until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

BDU:2023-00664

CVE-2022-42139

Affected Products

Delta Electronics Dvw-W02W2-E2

References · 7

• 🔥 https://cyberdanube.com/en/en-authenticated-command-injection-in-delta-electronics-dvw-w02w2-e2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42139 · Security Note
• https://bdu.fstec.ru/vul/2023-00664 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42139 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-23-033-04 · Note
• https://t.me/cibsecurity/54487 · Telegram Post
• https://t.me/cvenotify/39810 · Telegram Post