CVE-2022-40202
Assigner: icscert
Published: 2022-10-31T19:35:08.629Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: InfraSuite Device Master
vendor: Delta Electronics
versions: lessThanOrEqual: 00.00.01a
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: kimiya
type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Trend Micro Zero Day Initiative
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.</span>


value: 
The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-306
description: CWE-306 Missing Authentication for Critical Function
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev