Vulnerability · Published Dec 1, 2022 · Assigned by icscert
CVE-2022-2969ICSA-22-307-03 Delta Industrial Automation DIALink Path traversal
High 8.1
In plain English
A high-severity path traversal in DIALink from Delta Industrial Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Official description
Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Delta Industrial Automation | DIALink | 0 – before 1.5.0.0 Beta 4 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H