PT-2023-2368 · Delta Electronics · Infrasuite Device Master

Chudypd + 1 · Published 2023-03-21 · Updated 2023-05-17 · CVE-2023-1142

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.5

Description The issue allows an attacker to retrieve system files, credentials, and bypass authentication, resulting in privilege escalation. This can be achieved through URL decoding. Additionally, the vulnerability is related to the restoration of unreliable data in memory, which can be exploited by a remote attacker to execute arbitrary code using specially crafted UDP packets.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive system files and credentials to minimize the risk of exploitation. Avoid using URL decoding to retrieve system files until the issue is resolved.

Fix

Deserialization of Untrusted Data

Path traversal

Weakness Enumeration

CWE-502

CWE-22

Related Identifiers

BDU:2023-02143

CVE-2023-1142

ZDI-23-682

Affected Products

Infrasuite Device Master

References · 6

• https://zerodayinitiative.com/advisories/ZDI-23-682 · Security Note
• https://bdu.fstec.ru/vul/2023-02143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1142 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1142 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-02 · Note
• https://t.me/cibsecurity/60791 · Telegram Post