CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41772 – Delta Industrial Automation InfraSuite Device Master CheckLoadingStartupConfig Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41772
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master manejan mal los archivos .ZIP que contienen caracteres utilizados en el Path Traversal. Este Path Traversal podría resultar en la ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41778 – Delta Industrial Automation InfraSuite Device Master Device-Gateway Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41778
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization. Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores deserializan los datos proporcionados por el usuario proporcionados a través del puerto de servicio Device-DataCollect sin la verificación adecuada. Un atacante podría proporcionar objetos serializados maliciosos para ejecutar código arbitrario tras la deserialización. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41657 – Delta Industrial Automation InfraSuite Device Master CtrlLayerNWCmd_FileOperation Directory Traversal Arbitrary File Deletion Vulnerability
https://notcve.org/view.php?id=CVE-2022-41657
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). This could create arbitrary files, which could be used in API operations and could ultimately result in remote code execution. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master permiten que los datos proporcionados por el atacante ya serializados en la memoria se utilicen en interfaces programables de aplicaciones (APIs) de operación de archivos. Esto podría crear archivos arbitrarios, que podrían usarse en operaciones API y, en última instancia, podrían resultar en la ejecución remota de código. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41629 – Delta Industrial Automation InfraSuite Device Master APRunning Missing Authentication Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-41629
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as UserListInfo.xml, which would allow them to see existing administrative passwords. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master permiten que usuarios no autenticados accedan al endpoint de ejecución, lo que podría permitir a un atacante recuperar cualquier archivo del directorio ""RunningConfigs"". Luego, el atacante podría ver y modificar archivos de configuración como UserListInfo.xml, lo que le permitiría ver las contraseñas administrativas existentes. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43774
https://notcve.org/view.php?id=CVE-2022-43774
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. La clase HandlerPageP_KID de Delta Electronics DIAEnergy versión v1.9, contiene un fallo de Inyección SQL que podría permitir a un atacante conseguir una ejecución de código en un sistema remoto • https://www.tenable.com/security/research/tra-2022-33 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •