Skip to content
OpenAdvisories
High ICSA-24-123-02 3 CVEs

Delta Electronics DIAEnergie

Published May 2, 2024 · Updated May 2, 2024

Vendor: Delta Electronics Product: DIAEnergie

Summary

Successful exploitation of these vulnerabilities could allow an authenticated attacker with limited privileges to escalate privileges, retrieve confidential information, upload arbitrary files, backdoor the application, and compromise the system on which DIAEnergie is deployed.

Vulnerabilities 3

  • High 8.8
    CVE-2024-34031

    SQL Injection vulnerability in Delta Electronics DIAEnergie

    Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2024-34032

    SQL Injection in Delta Electronics DIAEnergie

    Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2024-34033

    Path Traversal vulnerability in Delta Electronics DIAEnergie

    Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file w…

    Delta Electronics DIAEnergie ICS / OT

Revision history

  1. #1

    Initial Publication

References