ICSA-22-307-03 Delta Industrial Automation DIALink Path traversal
Vulnerability Description
Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2969
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Y4er, working with Trend Micro Zero Day Initiative, reported this vulnerability to CISA.
Affected Vendor
Delta Industrial Automation
View all reports →