The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Delta Electronics | InfraSuite Device Master | unaffected |
|
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-43502 | The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution. |
| Link | Providers |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07 |
|
Wed, 16 Apr 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: icscert
Published:
Updated: 2025-04-16T16:06:43.696Z
Reserved: 2022-09-29T14:08:03.199Z
Link: CVE-2022-40202
Vulnrichment
Updated: 2024-08-03T12:14:39.961Z
NVD
Status : Modified
Published: 2022-10-31T20:15:12.987
Modified: 2024-11-21T07:21:03.447
Link: CVE-2022-40202
Redhat
No data.
OpenCVE Enrichment
No data.