CVE-2022-41629

Published Oct 31, 2022

Last updated a year ago

CVSS critical 9.1

Overview

Description: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as UserListInfo.xml, which would allow them to see existing administrative passwords.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

ics-cert@hq.dhs.gov: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0BC08CDF-4EE4-4E6D-AFF0-A4749A91A05D",
            "versionEndExcluding": "00.00.02a"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References