CVE-2022-2969

Description

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.

Reserved 2022-08-23 | Published 2022-12-01 | Updated 2024-08-03 | Assigner icscert

Problem types

CWE-22 Path Traversa

Product status

Default status
unaffected

Any version before 1.5.0.0 Beta 4
affected

Credits

Y4er, working with Trend Micro Zero Day Initiative, reported this vulnerability to CISA. finder

References

www.cisa.gov/uscert/ics/advisories/icsa-22-307-03

cve.org (CVE-2022-2969)

nvd.nist.gov (CVE-2022-2969)

Download JSON