CVE Vulnerability

CVE-2022-2969

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-03 Third Party Advisory US Government Resource
Configurations

Configuration 1

cpe:2.3:a:deltaww:dialink:1.5.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:deltaww:dialink:*:*:*:*:*:*:*:*
Information

Published : 2022-12-01 06:15

Updated : 2022-12-07 02:34

NVD link : CVE-2022-2969

Mitre link : CVE-2022-2969

Products Affected

Deltaww

Dialink

CWE
CWE-22