Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function
CVE-2023-39226

9.8CRITICAL

Key Information:

Vendor
Delta Electronics
Status
InfraSuite Device Master
Vendor
CVE Published:
30 November 2023

Summary

A vulnerability in Delta Electronics InfraSuite Device Master version 1.0.7 allows attackers to execute arbitrary code remotely without authentication through a specially crafted UDP packet. This issue poses potential risks to network security and the integrity of devices utilizing this software.

Affected Version(s)

InfraSuite Device Master 0 <= 1.0.7

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-3...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hir0ot and Piotr Bazydlo (@chudypb) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
.