CVE-2022-41772

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Delta Electronics	InfraSuite Device Master	<= 00.00.01a

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07Patch, Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07Patch, Third Party Advisory, US Government Resource

Timeline

Published: Oct 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417738.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privile CVE-2022-417758.8SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL que CVE-2022-417767.5Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method CVE-2022-417777.5Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earl CVE-2022-417788.8Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataColle CVE-2022-417799.8Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the devi CVE-2022-41788.8Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potenti CVE-2022-417805.5In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed locatio CVE-2022-417819.8Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.CVE-2022-417835.5tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of th CVE-2022-417847.8Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authenticated user to potent CVE-2022-417855.4Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.