Delta Electronics InfraSuite Device Master

CVE-2023-46690 represents the path traversal vulnerability, allowing attackers to traverse the file system to access files or directories outside the restricted directory. It uses external input to construct a pathname that should be within a restricted directory. Still, it does not correctly sanitize ‘…/…//’ sequences that can resolve to a location beyond that restricted directory. This vulnerability allows an attacker to write to any file in any filesystem location, which could lead to remote code execution.

CVE-2023-47207 identifies a deserialization of untrusted data vulnerability. Deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security. In other words, it deserializes untrusted data without sufficiently verifying that the resulting data will be valid, which allows an unauthenticated attacker to execute code with local administrator privileges.

Lastly, CVE-2023-47207 describes an Exposed Dangerous Method or Function. This weakness can lead to a wide variety of resultant weaknesses, depending on the behavior of the exposed method. The software interface includes a dangerous method or function that is not properly restricted. An unauthenticated attacker can execute arbitrary code through a single UDP packet.