Path traversal

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

Remote code execution

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces APIs. This could create arbitrary files, which could be used in API operations and could ultimately...

Design/Logic Flaw

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrativ...

CVE-2022-41629

Delta Electronics InfraSuite Device Master (versions 00.00.01a and prior) contains an unauthenticated access flaw in the aprunning endpoint that can let an attacker read files from the RunningConfigs directory and view/modify configuration files such as UserListInfo.xml, potentially exposing admi...

CVE-2022-41629

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as...

CVE-2022-41629

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrativ...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and older expose WriteConfiguration without authentication, enabling an attacker to alter user configuration files (e.g., UserListInfo.xml) and potentially change administrative passwords. Multiple sources (NVD, Red Hat CVE page, ZDI a...

CVE-2022-41644

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their own privileges...

CVE-2022-41644

Delta Electronics InfraSuite Device Master (versions 00.00.01a and prior) suffers from Missing Authentication for Critical Function in the Change Group Privileges/ModifyPrivByID pathway, enabling an unauthenticated user to create a denial-of-service state or escalate privileges. This is supported...

CVE-2022-41644

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their own privileges...

CVE-2022-41688

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attacker could provide malicious serialized objects that could run these functions without authentication to create a new user and add them to th...

CVE-2022-41688

Delta Electronics InfraSuite Device Master prior to 1.0.3 is affected by a missing authentication vulnerability in critical functions that create/modify user groups (notably the AddNewUser path). The root cause involves unauthenticated execution of operations that can create a new user and grant ...

CVE-2022-41688

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attacker could provide malicious serialized objects that could run these functions without authentication to create a new user and add them to th...

CVE-2022-40202

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication...

CVE-2022-40202

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication...

CVE-2022-40202

CVE-2022-40202 affects Delta Electronics InfraSuite Device Master (versions 00.00.01a and prior). The issue is due to unauthenticated deserialization of user-controlled data that allows triggering a backup scheduling function, which can execute arbitrary files/arguments and enable remote code exe...

CVE-2022-41772

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

CVE-2022-41772

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

CVE-2022-41772

Delta Electronics InfraSuite Device Master is affected by CVE-2022-41772: versions 00.00.01a and prior mishandle .ZIP archives with path traversal, enabling remote code execution. The issue arises from improper handling of ZIP content during extraction. Public advisories (CISA ICS, Red Hat, ZDI) ...