CVE-2022-41779

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07	Patch Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:52

Type	Values Removed	Values Added
Summary	Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.	Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.

Information

Published : 2022-10-31 20:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-41779

Mitre link : CVE-2022-41779

CVE.ORG link : CVE-2022-41779

JSON object : View

Products Affected

deltaww

infrasuite_device_master

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2022-41779", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-10-31T20:15:13.753", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "\nDelta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.\n\n"}, {"lang": "es", "value": "Delta Electronics InfraSuite Device Master versiones 00.00.01a y anteriores deserializan paquetes de red sin la verificaci\u00f3n adecuada. Si el dispositivo se conecta a un servidor controlado por un atacante, \u00e9ste podr\u00eda enviar paquetes creados con fines malintencionados que se deserializar\u00edan y ejecutar\u00edan, lo que provocar\u00eda la ejecuci\u00f3n remota de c\u00f3digo.\n"}], "lastModified": "2023-11-07T03:52:59.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BC08CDF-4EE4-4E6D-AFF0-A4749A91A05D", "versionEndExcluding": "00.00.02a"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}