Skip to content
OpenAdvisories
Critical ICSA-21-238-03 13 CVEs

Delta Electronics DIAEnergie (Update C)

Published Aug 26, 2021 · Updated Mar 22, 2022 · Revision 3

Vendor: Delta Electronics Product: DIAEnergie

Summary

Successful exploitation of these vulnerabilities could allow an attacker to retrieve passwords in cleartext, remotely execute code, cause a user to carry out an action unintentionally, or log in and use the device with administrative privileges.

Vulnerabilities 13

  • High 7.5
    CVE-2021-23228

    Delta Electronics DIAEnergie (Update A)

    DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.

    Delta Electronics DIAEnergie ICS / OT
  • High 7.5
    CVE-2021-44471

    Delta Electronics DIAEnergie (Update A)

    DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” of the script “DIAE_HandlerAlarmGroup.ashx”.

    Delta Electronics DIAEnergie ICS / OT
  • High 7.5
    CVE-2021-44544

    Delta Electronics DIAEnergie (Update A)

    DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of the script “HandlerEnergyType.ashx”.

    Delta Electronics DIAEnergie ICS / OT
  • High 7.1
    CVE-2022-0988

    Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information

    Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.

    Delta Electronics DIAEnergie ICS / OT
  • Medium 6.5
    CVE-2021-31558 EPSS 11%

    Delta Electronics DIAEnergie (Update A)

    DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.

    Delta Electronics DIAEnergie ICS / OT
  • Unscored —
    CVE-2021-32955 EPSS 37%

    Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to r…

  • Unscored —
    CVE-2021-32967

    Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without bei…

  • Unscored —
    CVE-2021-32983

    A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergi…

  • Unscored —
    CVE-2021-32991

    Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an at…

  • Unscored —
    CVE-2021-33003

    Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a …

  • Unscored —
    CVE-2021-38390 EPSS 20%

    A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIA…

  • Unscored —
    CVE-2021-38391

    A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEner…

  • Unscored —
    CVE-2021-38393 EPSS 18%

    A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIA…

Revision history

  1. #3

    ICSA-21-238-03 Delta Electronics DIAEnergie (Update B)

  2. #2

    ICSA-21-238-03 Delta Electronics DIAEnergie (Update A)

  3. #1

    ICSA-21-238-03 Delta Electronics DIAEnergie

References