CVE-2023-1133

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.

Score

CVSS 3.1 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2023-03-27

Last modified

2025-02-13

Weaknesses

CWE-502

Affected products

• Infrasuite Device Master (Delta Electronics)
• Infrasuite Device Master (Deltaww)

References

• http://packetstormsecurity.com/files/172799/Delta-Electronics-InfraSuite-Device-Master-Deserialization.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02