EUVD-2026-232429

fkie_cve-2022-42140

Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.

GHSA-83hh-2xcw-p8rr

Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.

ICSA-23-033-05 — Delta Electronics DX-2100-L1-CN

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.CVE-2022-42140 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected device contains a stored cross-site scripting vulnerability in the "net diagnosis" function in the web configuration service. This can be exploited in the context of a victim's session. An attacker could deliver a large variety of payloads that could lead to possibilities, such as remote code execution.-CVE-2023-0432 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Most recent entries from all

bdu:2023-00986

EUVD-2026-232429

fkie_cve-2022-42140

GHSA-83hh-2xcw-p8rr

gsd-2022-42140

ICSA-23-033-05 — Delta Electronics DX-2100-L1-CN