CVE-2022-40202: Critical severity Deltaww Infrasuite Device Master vulnerability
The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Delta Electronics InfraSuite Device Master database backup function to prevent unauthenticated attackers from invoking the backup scheduling feature.
Event History
Frequently Asked Questions
What is CVE-2022-40202?
CVE-2022-40202 is a vulnerability in the database backup function in Delta Electronics InfraSuite Device Master versions 00.00.01a and prior.
How does CVE-2022-40202 impact Delta Electronics InfraSuite Device Master?
CVE-2022-40202 allows attackers to activate an opcode for a backup scheduling function without authentication.
What is the severity of CVE-2022-40202?
CVE-2022-40202 has a severity rating of 9.8 (Critical).
What software versions are affected by CVE-2022-40202?
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior are affected by CVE-2022-40202.
Is there a fix for CVE-2022-40202?
No fix is currently available for CVE-2022-40202. It is recommended to follow the guidance provided by Delta Electronics or apply any security patches or updates when they become available.