Skip to main content

Infrasuite Device Master CVE-2022-41772

CRITICAL
Path Traversal (CWE-22)
2022-10-31 ics-cert@hq.dhs.gov
RCE Path Traversal Infrasuite Device Master
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 31, 2022 - 20:15 nvd
CRITICAL 9.8

DescriptionNVD

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution.

AnalysisAI

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution. Affected products include: Deltaww Infrasuite Device Master.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Infrasuite Device Master

View all
CVE-2023-1133 CRITICAL POC
9.8 Mar 27

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status se
CVE-2023-47207 CRITICAL
9.8 Nov 30

In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to
CVE-2023-39226 CRITICAL
9.8 Nov 30

In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to
CVE-2023-30765 CRITICAL
9.8 Jul 10

​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an
CVE-2023-34347 CRITICAL
9.8 Jul 10

​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which

CVE-2023-1142 CRITICAL
9.8 Mar 27

In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve sy
CVE-2023-1140 CRITICAL
9.8 Mar 27

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker

CVE-2022-41779 CRITICAL
9.8 Oct 31

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verif
CVE-2022-41657 CRITICAL
9.8 Oct 31

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized

CVE-2022-40202 CRITICAL
9.8 Oct 31

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper aut
CVE-2022-38142 CRITICAL
9.8 Oct 31

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through

CVE-2022-41629 CRITICAL
9.1 Oct 31

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunn

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-41772 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy