PT-2023-22964 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.7 Description: The issue is related to improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation...

Delta Electronics InfraSuite Device Master 访问控制错误漏洞

Delta Electronics InfraSuite Device Master is a device used to simplify and automate critical device monitoring by Delta Electronics of Taiwan, China. An Access Control Error vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.7 that stems from incorrect acces...

Delta Electronics InfraSuite Device Master Device-Gateway Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Device-Gateway service, which listens on TCP port 3100 by...

Delta Electronics InfraSuite Device Master 代码问题漏洞

Delta Electronics InfraSuite Device Master is a device used to simplify and automate critical device monitoring by Delta Electronics of Taiwan, China. A code issue vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.7 that stems from the inclusion of classes...

Delta Electronics InfraSuite Device Master APRunning Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Electronics InfraSuite Device Master. Authentication is required to exploit this vulnerability. The specific flaw exists within the gateway endpoint, which listens on TCP ports 80 and 4...

Delta Electronics InfraSuite Device Master modifyusergroup Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Delta Electronics InfraSuite Device Master. Authentication is required to exploit this vulnerability. The specific flaw exists within the modifyusergroup endpoint. The issue results from improper access...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on June 29, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-180-01 Delta Electronics InfraSuite Device Master ICSA-23-180-02 Schneider Electric...

Delta Electronics InfraSuite Device Master

1. EXECUTIVE SUMMARY ​CVSS v3 7.8 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Delta Electronics ​Equipment: InfraSuite Device Master ​Vulnerabilities: Improper Access Control, Deserialization of Untrusted Data 2. RISK EVALUATION ​Successful exploitation of these...

PT-2023-8742 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.7 Description: The issue is related to a deserialization mechanism flaw in Delta Electronics InfraSuite Device Master, which could allow a remote attacker to execute arbitrary...

Metasploit Weekly Wrap-Up

MOVEit It has been a busy few weeks in the security space; the MOVEit vulnerability filling our news feeds with dancing lemurs and a Barracuda vulnerability that has us all wondering how many shredders out there can handle a 1U appliance. Despite those very worthwhile distractions, Metasploit has...

Delta Electronics InfraSuite Device Master Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Delta Electronics InfraSuite Device Master Deserialization', 'Description' = %q Delta Electronics InfraSuite Device Master versions below v1.0.5...

CVE-2023-24014

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-25177

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-25177

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code...

Heap overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code...

Stack overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-25177 Delta Electronics CNCSoft-B DOPSoft Stack-based buffer overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-25177

CVE-2023-25177 affects Delta Electronics CNCSoft-B DOPSoft (HMI). The root cause is a stack-based buffer overflow in the DOPSoft/DPA file parsing, affecting versions prior to 4.0.0.82. Successful exploitation could allow arbitrary code execution. Some advisories note remote code execution requiri...

CVE-2023-25177 Delta Electronics CNCSoft-B DOPSoft Stack-based buffer overflow

Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code...

CVE-2023-24014

CVE-2023-24014 maps to a heap-based buffer overflow in Delta Electronics CNCSoft-B DOPSoft (DOPSoft component) affecting versions prior to a fixed release. The vulnerability arises when DOPSoft processes DPA files, enabling an attacker to execute arbitrary code in the context of the current user....