CVE-2022-41779 Deserialization in InfraSuite Device Master
Attackers can achieve remote code execution by sending malicious packets to Delta InfraSuite Device Master if it connects to an attacker-controlled server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41779?
CVE-2022-41779 is a high-severity unsafe deserialization vulnerability in Delta Electronics InfraSuite Device Master, published on 31 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.
Weakness: CWE-502
Which versions are affected by CVE-2022-41779?
It affects 1 product.
Products include Deltaww Infrasuite Device Master.
How do I fix CVE-2022-41779?
No fix has been published for CVE-2022-41779 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-41779 being exploited?
There is no known exploitation of CVE-2022-41779 in the wild and no public exploit code.
Other vulnerabilities in Delta Electronics InfraSuite Device Master
- CVE-2023-39226 Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function
- CVE-2023-47207 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
- CVE-2023-34347 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
- CVE-2023-1133 CVE-2023-1133
- CVE-2023-1136 CVE-2023-1136
Sources
Also known as GHSA-gf6f-vfgf-69vf.