CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41778 – Delta Industrial Automation InfraSuite Device Master Device-Gateway Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41778
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization. Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores deserializan los datos proporcionados por el usuario proporcionados a través del puerto de servicio Device-DataCollect sin la verificación adecuada. Un atacante podría proporcionar objetos serializados maliciosos para ejecutar código arbitrario tras la deserialización. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41657 – Delta Industrial Automation InfraSuite Device Master CtrlLayerNWCmd_FileOperation Directory Traversal Arbitrary File Deletion Vulnerability
https://notcve.org/view.php?id=CVE-2022-41657
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). This could create arbitrary files, which could be used in API operations and could ultimately result in remote code execution. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master permiten que los datos proporcionados por el atacante ya serializados en la memoria se utilicen en interfaces programables de aplicaciones (APIs) de operación de archivos. Esto podría crear archivos arbitrarios, que podrían usarse en operaciones API y, en última instancia, podrían resultar en la ejecución remota de código. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •