// For flags

CVE-2022-40202

Delta Industrial Automation InfraSuite Device Master ExeCommandInCommandLineMode Missing Authentication Remote Code Execution Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.

La función de copia de seguridad de la base de datos en Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores carece de autenticación adecuada. Un atacante podría proporcionar objetos serializados maliciosos que, cuando se deserialicen, podrían activar un código de operación para una función de programación de copias de seguridad sin autenticación. Esta función permite al usuario designar todos los argumentos de la función y el archivo que se ejecutará. Esto podría permitir al atacante iniciar cualquier proceso nuevo y lograr la ejecución remota de código.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ExeCommandInCommandLineMode function. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of an administrator.

*Credits: kimiya, Trend Micro Zero Day Initiative
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-29 CVE Reserved
  • 2022-10-27 CVE Published
  • 2024-06-07 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 2023-11-07
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Deltaww
Search vendor "Deltaww"
 Infrasuite Device Master
Search vendor "Deltaww" for product "Infrasuite Device Master"
 < 00.00.02a
Search vendor "Deltaww" for product "Infrasuite Device Master" and version " < 00.00.02a"
-
Affected