CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41776 – Delta Industrial Automation InfraSuite Device Master WriteConfiguration Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-41776
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords. Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores permiten a usuarios no autenticados activar el método WriteConfiguration, lo que podría permitir a un atacante proporcionar nuevos valores para archivos de configuración de usuario como UserListInfo.xml. Esto podría dar lugar al cambio de contraseñas administrativas. This vulnerability allows remote attackers to bypass authentication on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41779 – Delta Industrial Automation InfraSuite Device Master DeSerializeBinary Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41779
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution. Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores deserializan paquetes de red sin la verificación adecuada. Si el dispositivo se conecta a un servidor controlado por un atacante, éste podría enviar paquetes creados con fines malintencionados que se deserializarían y ejecutarían, lo que provocaría la ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master Device-Monitor. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41778 – Delta Industrial Automation InfraSuite Device Master Device-Gateway Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41778
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization. Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores deserializan los datos proporcionados por el usuario proporcionados a través del puerto de servicio Device-DataCollect sin la verificación adecuada. Un atacante podría proporcionar objetos serializados maliciosos para ejecutar código arbitrario tras la deserialización. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41657 – Delta Industrial Automation InfraSuite Device Master CtrlLayerNWCmd_FileOperation Directory Traversal Arbitrary File Deletion Vulnerability
https://notcve.org/view.php?id=CVE-2022-41657
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). This could create arbitrary files, which could be used in API operations and could ultimately result in remote code execution. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master permiten que los datos proporcionados por el atacante ya serializados en la memoria se utilicen en interfaces programables de aplicaciones (APIs) de operación de archivos. Esto podría crear archivos arbitrarios, que podrían usarse en operaciones API y, en última instancia, podrían resultar en la ejecución remota de código. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43775
https://notcve.org/view.php?id=CVE-2022-43775
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. La clase HICT_Loop en Delta Electronics DIAEnergy versión v1.9, contiene un fallo de Inyección SQL que podría permitir a un atacante conseguir una ejecución de código en un sistema remoto • https://www.tenable.com/security/research/tra-2022-33 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •