by Kastro
Paper/Archive/CVE-2023-34347

CVE-2023-34347

Delta Electronics Infrasuite Device Master — ​Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.3.613 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code.

Affected

ProductAffectedFixed inSource
Infrasuite Device Master< v1.0.7v1.0.7CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-180-01