Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-1145: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization...
CVE-2023-1145 · published 3 years ago
Summary
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
What to do
- Update deltaww infrasuite_device_master to version 1.0.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| deltaww | infrasuite_device_master |
< 1.0.5 cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:* |
Original advisory text
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization...
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02 Third Party Advisory US Government Resource
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published27 Mar 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-1145 · NVD
Track software like this
Free during beta