PT-2023-7702 · Delta Electronics · Infrasuite Device Master

Chudypb + 2 · Published 2023-11-28 · Updated 2023-12-11 · CVE-2023-47207

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics InfraSuite Device Master version 1.0.7

Description The issue is related to the deserialization of untrusted data, which can lead to remote code execution. An unauthenticated attacker can exploit this to execute code with local administrator privileges. This can potentially allow a remote attacker to gain elevated access to the system.

Recommendations For Delta Electronics InfraSuite Device Master version 1.0.7, consider restricting access to the Device-DataCollect and Device-Gateway components until a patch is available. As a temporary workaround, disabling the deserialization of untrusted data may help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-08769

CVE-2023-47207

ZDI-23-1753

ZDI-23-1754

Affected Products

Infrasuite Device Master

References · 10

• https://bdu.fstec.ru/vul/2023-08769 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47207 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1754 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47207 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1753 · Security Note
• https://t.me/cvenotify/62567 · Telegram Post
• https://t.me/cvenotify/61827 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-331-01 · Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-21771 · Note
• https://t.me/true_secator/5187 · Telegram Post