CVE-2022-41776

Published Oct 31, 2022

Last updated a year ago

Overview

Description: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

ics-cert@hq.dhs.gov: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0BC08CDF-4EE4-4E6D-AFF0-A4749A91A05D",
            "versionEndExcluding": "00.00.02a"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References