Skip to content
OpenAdvisories
High ICSA-22-298-06 14 CVEs

Delta Electronics DIAEnergie

Published Nov 10, 2022 · Updated Feb 16, 2023 · Revision 2

Vendor: Delta Electronics Product: DIAEnergie

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-22-298-06 Delta Electronics DIAEnergie (Update A) that was published November 10, 2022, to the ICS webpage at www.cisa.gov/uscert.

Vulnerabilities 14

  • High 8.8
    CVE-2022-40967

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-41133 EPSS 27%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-41773

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-41775

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43447

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43452

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43457

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43506

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2023-0822

    Improper Authorization

    The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.7
    CVE-2022-40965 EPSS 11%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.7
    CVE-2022-41555 EPSS 11%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.7
    CVE-2022-41651 EPSS 11%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.7
    CVE-2022-41701 EPSS 11%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.7
    CVE-2022-41702 EPSS 11%

    Delta Electronics DIAEnergie

    The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API.

    Delta Electronics DIAEnergie ICS / OT

Revision history

  1. #2

    Delta Electronics DIAEnergie (Update A)

  2. #1

    Delta Electronics DIAEnergie (Update B)

References