CVE-2022-40202: critical vulnerability in Delta Electronics InfraSuite Device Master
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.6%
The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Delta Electronics · InfraSuite Device MasterRelated CVEs — Delta Electronics InfraSuite Device Master
In the same product, most dangerous first.
CVE-2023-1133CRITICALCVE-2023-1133EPSS 50.0%CVE-2022-41772CRITICALCVE-2022-41772EPSS 25.4%CVE-2022-41657CRITICALCVE-2022-41657EPSS 21.3%CVE-2022-38142CRITICALCVE-2022-38142EPSS 18.6%CVE-2024-10456CRITICALDelta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 17.6%CVE-2023-47207CRITICALDelta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 16.6%