CVE-2023-1142 CVE-2023-1142

2023-03-2714:48:55

icscert

www.cve.org

delta infrasuite device master

url decoding

attacker

system files

credentials

authentication

privilege escalation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

55.6%

JSON

In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.

CNA Affected

[
  {
    "vendor": "Delta Electronics",
    "product": "InfraSuite Device Master",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.0.5",
        "versionType": "custom"
      }
    ]
  }
]