PT-2023-2321 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Published 2023-03-21 · Updated 2023-05-17 · CVE-2023-1141

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue is related to a command injection vulnerability that could allow an attacker to inject arbitrary commands, potentially resulting in remote code execution. The vulnerability is associated with inadequate data cleaning measures at the management level, which could be exploited by a remote attacker to execute arbitrary code.

Recommendations For Delta Electronics InfraSuite Device Master versions prior to 1.0.5, update to version 1.0.5 or later to resolve the command injection vulnerability. As a temporary workaround, consider restricting access to the command line interface to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-02086

CVE-2023-1141

ZDI-23-684

Affected Products

Infrasuite Device Master

References · 5

• https://zerodayinitiative.com/advisories/ZDI-23-684 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1141 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1141 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02086 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Note