Read the docs
TI-2023-00421 Aliases CVE-2023-0444GHSA-6q37-hw9r-5p8c

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privileged user to log in as an administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0102 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Delta Electronics InfraSuite Device Master 00.00.02aDelta Electronics InfraSuite Device Master 00.00.02a—No fix listedCNA
  • Delta Electronics InfraSuite Device Master 00.00.02a Vendor— Affected Delta Electronics InfraSuite Device Master 00.00.02a Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deltaww:infrasuite_device_master:00.00.02a:*:*:*:*:*:*:*00.00.02aVulnerabledeltaww
  • cpe:2.3:a:deltaww:infrasuite_device_master:00.00.02a:*:*:*:*:*:*:* Versions 00.00.02a Vulnerable ·deltaww

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0444
  2. 2026-10-03 Alias added: GHSA-6q37-hw9r-5p8c

References

Advisory 1

  • TI-2023-01071 Deserialization of untrusted data in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2022-20149 Path traversal in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2022-20052 Path traversal in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2022-17846 Deserialization of untrusted data in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2023-25527 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
  • TI-2022-19068 Missing authentication in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences