PT-2023-7641 · Delta Electronics · Infrasuite Device Master

Hir0Ot + 1 · Published 2023-11-28 · Updated 2023-12-11 · CVE-2023-46690

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description A vulnerability exists in Delta Electronics InfraSuite Device Master that allows an attacker to write to any file in any location of the filesystem, potentially leading to remote code execution. This issue arises due to incorrect restriction of the directory path name with limited access. The exploitation of this vulnerability could enable a remote attacker to execute arbitrary code.

Recommendations For version 1.0.7, update to a newer version that contains a fix for this issue, as the current version allows for directory traversal and remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

BDU:2023-08702

CVE-2023-46690

ZDI-23-1752

Affected Products

Infrasuite Device Master

References · 9

• https://osv.dev/vulnerability/CVE-2023-46690 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08702 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46690 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1752 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-21707 · Note
• https://t.me/cvenotify/61826 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Note
• https://t.me/true_secator/5187 · Telegram Post
• https://t.me/cvenotify/62566 · Telegram Post