Critical ICSA-22-298-07 10 CVEs

Delta Electronics InfraSuite Device Master

Published Oct 25, 2022 · Updated Jan 18, 2023 · Revision 2

Vendor: Delta Electronics Product: InfraSuite Device Master

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to remotely execute code, cause a denial-of-service condition by remotely deleting files or changing group privileges, or remotely read and write files, all with local administrator privileges.

Vulnerabilities 10

Critical 9.8

CVE-2022-38142 EPSS 19%

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
Critical 9.8

CVE-2022-40202

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper au…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
Critical 9.8

CVE-2022-41657 EPSS 21%

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
Critical 9.8

CVE-2022-41688

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that c…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
Critical 9.8

CVE-2022-41772 EPSS 25%

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters u…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
Critical 9.8

CVE-2022-41778

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through…

Delta Electronics InfraSuite Device Master ICS / OT

Jan 12, 2023
High 8.8

CVE-2022-41644

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that change…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
High 8.8

CVE-2022-41779

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper veri…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
High 7.5

CVE-2022-41629

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprun…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022
High 7.5

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the Writ…

Delta Electronics InfraSuite Device Master ICS / OT

Oct 31, 2022

Revision history

2023-01-18 #2
Delta Electronics InfraSuite Device Master (Update A)
2022-10-25 #1
Delta Electronics InfraSuite Device Master (Update A)

References

ICS Advisory ICSA-22-298-07 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-298-07
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-22-298-07
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf