CVE-2022-42140: OS Command Injection

Reference Links

• https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-033-05 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-23-033-05

Frequently Asked Questions

• What is the severity of CVE-2022-42140?

  The severity of CVE-2022-42140 is high with a severity value of 7.2.

• How does Delta Electronics DX-2100-L1-CN 2.42 become vulnerable to Command Injection?

  Delta Electronics DX-2100-L1-CN 2.42 becomes vulnerable to Command Injection via lform/net_diagnose.

• Which software versions of Delta Electronics DX-2100-L1-CN are affected by CVE-2022-42140?

  The affected software version of Delta Electronics DX-2100-L1-CN is 1.5.0.10.

• Is Delta Electronics DX-2100-L1-CN currently vulnerable to CVE-2022-42140?

  Yes, Delta Electronics DX-2100-L1-CN is currently vulnerable to CVE-2022-42140.

• How can I fix the Command Injection vulnerability in Delta Electronics DX-2100-L1-CN 2.42?

  To fix the Command Injection vulnerability in Delta Electronics DX-2100-L1-CN 2.42, update to a non-vulnerable version or apply the necessary patches from the vendor.