Configuration Management Vulnerability in Delta Electronics InfraSuite Device Master
CVE-2022-41776

7.5HIGH

Key Information:

Vendor: Delta Electronics
Status: Infrasuite Device Master
Vendor: CVE Published:; 31 October 2022

🔔 Create Delta Electronics Vulnerability Alert

What is CVE-2022-41776?

The vulnerability in Delta Electronics' InfraSuite Device Master allows unauthenticated users to exploit the WriteConfiguration method. This exploit enables attackers to alter essential configuration files, notably UserListInfo.xml. As a result, unauthorized changes to administrative passwords can occur, compromising system integrity and access control.

Affected Version(s)

InfraSuite Device Master 0 <= 00.00.01a

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07

government-resource

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Oct 31, 2022
Vulnerability Reserved
Sep 29, 2022

Credit

kimiya

Trend Micro Zero Day Initiative

JSON