The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 | Patch Third Party Advisory US Government Resource |
Configurations
History
07 Nov 2023, 03:52
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution. |
02 Nov 2022, 12:59
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 - Patch, Third Party Advisory, US Government Resource | |
| First Time |
Deltaww
Deltaww infrasuite Device Master |
31 Oct 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-31 20:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-40202
Mitre link : CVE-2022-40202
CVE.ORG link : CVE-2022-40202
JSON object : View
Products Affected
deltaww
- infrasuite_device_master
CWE
CWE-306
Missing Authentication for Critical Function