PT-2023-24808 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Published 2023-07-10 · Updated 2023-07-17 · CVE-2023-34316

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master versions prior to 1.0.7

Description An attacker could bypass the latest patch, allowing them to retrieve file contents due to improper access control. This issue affects Delta Electronics InfraSuite Device Master, enabling information disclosure.

Recommendations For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Improper Access Control

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-552

Related Identifiers

CVE-2023-34316

ZDI-23-904

Affected Products

Infrasuite Device Master

References · 7

• https://osv.dev/vulnerability/CVE-2023-34316 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-904 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-180-01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-34316 · Security Note
• https://t.me/cvenotify/54505 · Telegram Post
• https://t.me/cibsecurity/66309 · Telegram Post
• https://t.me/cvenotify/54000 · Telegram Post