CVE-2023-1133: delta electronics infrasuite device master Deserialization of Untrusted Data

Vulnerability summary

CVE-2023-1133 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in delta electronics infrasuite device master. EPSS estimates a 50.05% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-03-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.