CVE-2023-1133

What it actually does

Delta Electronics InfraSuite Device Master versions before 1.0.5 expose a Device-status UDP service on port 10100 that accepts unauthenticated packets and deserializes their contents without proper verification. Because the flaw is remotely reachable, requires no credentials or user interaction, and can lead to arbitrary code execution, a successful attacker can execute commands in the context of the vulnerable service and potentially gain full control over the host running Device Master. The CVSS 9.8 rating reflects complete confidentiality, integrity, and availability impact; the EPSS score around 0.50 and weaponized exploit maturity indicate a meaningful likelihood of exploitation where the service is exposed.

Why it matters to the business

Compromise of InfraSuite Device Master can disrupt monitoring and management of facility, power, and infrastructure devices, potentially affecting data center or industrial operations that depend on the platform. An attacker who gains code execution could tamper with device status visibility, pivot further into operational networks, deploy malware, or cause outages by disabling or manipulating management services. Because exploitation is unauthenticated over the network and weaponized exploit capability is reported, internet-exposed or broadly reachable deployments should be treated as high priority even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a host running Delta Electronics InfraSuite Device Master with UDP port 10100 reachable. They then send crafted UDP packets to the Device-status service. The vulnerable service accepts the packets without authentication or sufficient validation and deserializes attacker-controlled content. During deserialization, the malicious payload triggers code execution inside the Device Master process. Once code execution is achieved, the attacker may run system commands, install persistence, alter application files or configuration, harvest credentials available to the service account, disable monitoring, or use the compromised host as a foothold to reach other management or operational systems.

How to fix it

Upgrade Delta Electronics InfraSuite Device Master to version 1.0.5 or later, as versions prior to 1.0.5 are affected. If immediate upgrade is not possible, restrict UDP port 10100 to only trusted management networks and known administrative hosts, block inbound access from untrusted networks, and prevent internet exposure. Where feasible, disable the Device-status UDP service if it is not required. Place the application behind network segmentation controls, monitor for unexpected traffic to UDP/10100, and run the service with the least privileges possible to limit post-exploitation impact. After patching, restart the application/service to ensure the fixed binaries and configuration are active.

How to confirm the fix worked

Confirm the installed InfraSuite Device Master version is 1.0.5 or later through the product UI, package metadata, file properties, or vendor-supported version reporting. Verify that UDP port 10100 is not exposed to the internet or untrusted network segments using external and internal network scanning. On the host, confirm whether a process is listening on UDP/10100 and whether firewall rules limit access to approved sources. Validate that vulnerable versions prior to 1.0.5 are no longer present in software inventory. If compensating controls are used, test that unauthenticated UDP traffic to port 10100 is blocked from non-approved networks.

Typical attack path

1. Scan for systems exposing UDP port 10100 associated with Delta Electronics InfraSuite Device Master.
2. Confirm the service responds as the Device-status service or behaves consistently with InfraSuite Device Master.
3. Send a crafted unauthenticated UDP payload designed to abuse unsafe deserialization.
4. Achieve arbitrary code execution under the privileges of the vulnerable service process.
5. Execute follow-on commands such as payload staging, reconnaissance, credential access, or persistence.
6. Pivot from the Device Master host toward adjacent infrastructure management, OT, or IT systems.

How to detect it

To determine whether exploitation already occurred, review network telemetry, firewall logs, IDS/IPS events, and packet captures for unexpected inbound UDP traffic to port 10100, especially from external, unfamiliar, or broadly scanning sources. On hosts running InfraSuite Device Master, examine Windows Event Logs, application logs, service logs, EDR telemetry, and process creation records for abnormal behavior by the Device Master or Device-status service, including crashes, restarts, unexpected child processes, command interpreters, script engines, file downloads, or outbound connections shortly after UDP/10100 activity. Investigate creation or modification of unfamiliar files in the application directory, temporary directories, startup locations, scheduled tasks, services, and user profile paths. Because exploitation results in arbitrary code execution rather than a fixed on-disk artifact, detection should correlate network access to UDP/10100 with host-level signs of command execution, persistence, credential access, and lateral movement. If threat hunting is available, search historical telemetry from the publication date onward and prioritize systems that were running versions before 1.0.5 or had UDP/10100 reachable from untrusted networks.

• UDP/10100
• port 10100/UDP
• Device-status service
• InfraSuite Device Master
• inbound UDP traffic to port 10100
• unexpected process spawned by InfraSuite Device Master
• cmd.exe spawned by InfraSuite Device Master
• powershell.exe spawned by InfraSuite Device Master
• wscript.exe spawned by InfraSuite Device Master
• cscript.exe spawned by InfraSuite Device Master
• certutil.exe spawned by InfraSuite Device Master
• bitsadmin.exe spawned by InfraSuite Device Master
• rundll32.exe spawned by InfraSuite Device Master
• regsvr32.exe spawned by InfraSuite Device Master

What your security team should do

• Immediately inventory Delta Electronics InfraSuite Device Master deployments and identify any versions prior to 1.0.5.
• Prioritize upgrade to InfraSuite Device Master 1.0.5 or later, especially for systems reachable from untrusted networks.
• Block or tightly restrict UDP port 10100 at network firewalls, host firewalls, and segmentation boundaries.
• Review exposure from both internet-facing and internal network perspectives; unsafe deserialization vulnerabilities are often used for initial access and lateral movement.
• Enable heightened monitoring for UDP/10100 traffic, crashes or restarts of the Device Master service, and unexpected child processes spawned by the application.
• Conduct compromise assessment on exposed or previously exposed hosts, focusing on evidence of remote command execution, payload staging, persistence, and lateral movement.
• Run the service under a low-privilege account and review local administrator membership and credential exposure on systems hosting the product.
• Document any temporary mitigations and track them to permanent remediation through upgrade or decommissioning.