Vulnerability · Published May 6, 2024 · Assigned by tenable
CVE-2024-4548Delta Electronics DIAEnergie SQL Injection
Critical 9.8
In plain English
A critical-severity improper input validation in DIAEnergie from Delta Electronics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 29.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)29.4%top 1.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Delta Electronics | DIAEnergie | 0 – through 1.10.1.8610 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H