Vulnerability Description
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as UserListInfo.xml, which would allow them to see existing administrative passwords.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Deltaww | Infrasuite Device Master | < 00.00.02a |
Related Weaknesses (CWE)
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07PatchThird Party AdvisoryUS Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07PatchThird Party AdvisoryUS Government Resource
FAQ
What is CVE-2022-41629?
CVE-2022-41629 is a vulnerability with a CVSS score of 7.5 (HIGH). Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “Runn...
How severe is CVE-2022-41629?
CVE-2022-41629 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-41629?
Check the references section above for vendor advisories and patch information. Affected products include: Deltaww Infrasuite Device Master.