CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords.

Score

CVSS 3.1 7.5 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2022-10-31

Last modified

2025-04-16

Weaknesses

CWE-306

Affected products

• Infrasuite Device Master (Delta Electronics)
• Infrasuite Device Master (Deltaww)

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07