CVE-2022-2969 | THREATINT

Assigner	icscert
Reserved	2022-08-23
Published	2022-12-01
Updated	2024-08-03

Description

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.

HIGH: 8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Product status

Default status

unaffected

Any version before 1.5.0.0 Beta 4

affected

Credits

Y4er, working with Trend Micro Zero Day Initiative, reported this vulnerability to CISA. finder

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-03

cve.org CVE-2022-2969

nvd.nist.gov CVE-2022-2969

Download JSON

https://cve.threatint.com/CVE/CVE-2022-2969

Support options

Helpdesk Telegram

Subscribe to our newsletter to learn more about our work.