CVE-2022-41629 – Delta Industrial Automation InfraSuite Device Master APRunning Missing Authentication Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2022-41629

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as UserListInfo.xml, which would allow them to see existing administrative passwords. Las versiones 00.00.01a y anteriores de Delta Electronics InfraSuite Device Master permiten que usuarios no autenticados accedan al endpoint de ejecución, lo que podría permitir a un atacante recuperar cualquier archivo del directorio ""RunningConfigs"". Luego, el atacante podría ver y modificar archivos de configuración como UserListInfo.xml, lo que le permitiría ver las contraseñas administrativas existentes. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Industrial Automation InfraSuite Device Master. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 • CWE-306: Missing Authentication for Critical Function •