Delta Electronics InfraSuite Device Master

🗓️ 28 Nov 2023 07:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 52 Views

Delta Electronics InfraSuite Device Master vulnerabilities CVSS v3 9.8. Allows remote code execution, plaintext credentials retrieva

Reporter	Title	Published	Views	Family All 44
BDU FSTEC	The vulnerability of the Delta Electronics InfraSuite Device Master software in real-time monitoring of devices, related to the use of dangerous methods or functions, allows a perpetrator to execute arbitrary codes.	6 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring lies in improper restrictions on path names in the catalog. This allows attackers to disclose user information, obtain login credentials in plain text, or perform NTLM relay attacks.	6 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Delta Electronics InfraSuite Device Master software in monitoring devices in real time arises from an incorrect limitation on the path name to the restricted access catalog. This allows a perpetrator to write to any file anywhere within the file system.	14 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring lies in its ability to restore unreliable data in memory, allowing an attacker to execute commands with local administrator privileges.	15 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-39226	11 Dec 202317:10	–	circl
Circl	CVE-2023-46690	11 Dec 202317:10	–	circl
Circl	CVE-2023-47207	11 Dec 202317:10	–	circl
Circl	CVE-2023-47279	11 Dec 202317:10	–	circl
CNNVD	Delta Electronics InfraSuite Device Master Security Vulnerability	30 Nov 202300:00	–	cnnvd
CNNVD	Delta Electronics InfraSuite Device Master Security Vulnerability	30 Nov 202300:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-331-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
cisa	www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
cisa	www.cisa.gov/uscert/ncas/tips/ST04-014
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

28 Nov 2023 07:00Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.16573

SSVC

delta electronics infrasuite device master vulnerabilities remote code execution plaintext credentials path traversal deserialization of untrusted data exposed dangerous method critical infrastructure taiwan trend micro