CVE-2022-40202

CVE-2022-40202 affects Delta Electronics InfraSuite Device Master (versions 00.00.01a and prior). The issue is due to unauthenticated deserialization of user-controlled data that allows triggering a backup scheduling function, which can execute arbitrary files/arguments and enable remote code exe...

CVE-2022-41772

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

CVE-2022-41772

Delta Electronics InfraSuite Device Master is affected by CVE-2022-41772: versions 00.00.01a and prior mishandle .ZIP archives with path traversal, enabling remote code execution. The issue arises from improper handling of ZIP content during extraction. Public advisories (CISA ICS, Red Hat, ZDI) ...

CVE-2022-41657

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces APIs. This could create arbitrary files, which could be used in API operations and could ultimately...

CVE-2022-41657

Delta Electronics InfraSuite Device Master (versions 00.00.01a and earlier) is affected by multiple CVEs describing an in-memory deserialization/vector issue in file operation APIs that can lead to arbitrary file creation and remote code execution. ZDI advisories for CtrlLayerNWCmd_FileOperation ...

CVE-2022-41779

Delta Electronics InfraSuite Device Master is affected by CVE-2022-41779. The issue is a deserialization of untrusted data in network packets that can be received from an attacker-controlled server, enabling remote code execution on versions 00.00.01a and prior. Evidence across sources confirms t...

CVE-2022-41779

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote...

CVE-2022-38142

CVE-2022-38142 affects Delta Electronics InfraSuite Device Master, versions 00.00.01a and prior. The vulnerability arises from deserialization of untrusted data received through the Device-DataCollect/Device-Gateway interfaces, with the ZDI advisory noting a lack of proper validation on the port ...

CVE-2022-38142

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization...

CVE-2022-38142

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization...

Delta Industrial Automation InfraSuite Device Master CtrlLayerNWCmd_FileOperation Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CtrlLayerNWCmdFileOperation function. When...

PT-2022-26026 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns a lack of proper authentication for functions that create and modify user groups. An attacker could exploit this by providing malicious...

PT-2022-26069 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue allows remote code execution due to deserialization of untrusted data. If the device connects to an attacker-controlled server, the attacker could...

PT-2022-26063 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns the mishandling of .ZIP archives containing characters used in path traversal, which could result in remote code execution. This path...

PT-2022-26068 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue allows an attacker to execute arbitrary code by providing malicious serialized objects through the Device-DataCollect service port without proper...

Delta Industrial Automation InfraSuite Device Master ExeCommandInCommandLineMode Missing Authentication Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ExeCommandInCommandLineMode function. The issue...

Delta Industrial Automation InfraSuite Device Master APRunning Missing Authentication Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gateway endpoint, which listens on TCP...

Delta Industrial Automation InfraSuite Device Master ModifyPrivByID Missing Authentication Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges or create a denial-of-service condition on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to create a denial-of-service condition. Authentication is required to achiev...

PT-2022-24234 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns the deserialization of user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could...

PT-2022-26001 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their...