Delta Electronics InfraSuite Device Master
Act Now9.8ICS-CERT ICSA-23-180-01Jun 29, 2023
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain multiple vulnerabilities in privilege escalation and code execution pathways (CWE-552: improper permissions, CWE-269: improper access control, CWE-502: deserialization of untrusted data). Successful exploitation could allow an attacker to escalate privileges or remotely execute arbitrary code.
What this means
What could happen
An attacker with network access to InfraSuite Device Master could execute arbitrary commands on the system, potentially gaining administrative control over facility device management, energy distribution, or critical infrastructure monitoring and control functions.
Who's at risk
This impacts water utilities, electric utilities, and any municipal or industrial operator running Delta Electronics InfraSuite Device Master for centralized device monitoring and control. The Device Master platform is commonly deployed as a management layer for distributed energy resources, building management systems, and facility automation infrastructure.
How it could be exploited
The attacker reaches the InfraSuite Device Master service over the network and exploits deserialization or permission-related weaknesses to escalate privileges. Once elevated, the attacker can execute arbitrary code with administrative rights to alter system behavior, inject malicious commands, or compromise connected devices managed by the platform.
Prerequisites
- Network access to InfraSuite Device Master on its listening port
- No authentication required for exploitation (public details not disclosed, but CVSS vector PR:N indicates no privileges needed)
Remotely exploitableNo authentication requiredLow complexity attackCritical CVSS score (9.8)Affects system management platform with control over facility devicesNo public exploits known but high intrinsic risk
Exploitability
Low exploit probability (EPSS 0.7%)
Affected products (1)
ProductAffected VersionsFix Status
InfraSuite Device Master: <1.0.7<1.0.71.0.7
Remediation & Mitigation
0/4
Do now
0/1HARDENINGIsolate InfraSuite Device Master from the Internet and place behind a firewall
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Delta Electronics InfraSuite Device Master to version 1.0.7 or later
Long-term hardening
0/2HARDENINGSegment the control system network from business networks
HARDENINGIf remote access is required, implement a VPN and ensure it is kept current
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f0ff27a1-abca-40b3-8aa2-be47ebaaa9a7