PT-2023-7416 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Published 2023-11-28 · Updated 2023-12-11 · CVE-2023-39226

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description The issue is related to the use of dangerous methods or functions in the software, allowing a remote attacker to execute arbitrary code by sending a specially crafted UDP packet. This can be achieved through a single UDP packet, enabling an unauthenticated attacker to perform the exploit.

Recommendations For Delta Electronics InfraSuite Device Master version 1.0.7, consider disabling the vulnerable function or restricting access to the affected module until a patch is available. As a temporary workaround, avoid using the RunScript function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-749

Related Identifiers

BDU:2023-08453

CVE-2023-39226

ZDI-23-1755

Affected Products

Infrasuite Device Master

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-39226 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1755 · Security Note
• https://bdu.fstec.ru/vul/2023-08453 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39226 · Vendor Advisory
• https://t.me/cvenotify/62537 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Note
• https://t.me/cvenotify/61825 · Telegram Post
• https://t.me/true_secator/5187 · Telegram Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-21859 · Note