Vulnerability · Published Mar 27, 2023 · Assigned by icscert
CVE-2023-1133CVE-2023-1133
Critical 9.8
In plain English
A critical-severity security flaw in InfraSuite Device Master from Delta Electronics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 50.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)50.0%top 1.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Delta Electronics | InfraSuite Device Master | 0 – before 1.0.5 |