CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4549 – Delta Electronics DIAEnergie SQL Injection
https://notcve.org/view.php?id=CVE-2024-4549
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system. Existe una vulnerabilidad de denegación de servicio en Delta Electronics DIAEnergie v1.10.1.8610 y anteriores. Al procesar un mensaje 'ICS Restart! • https://www.tenable.com/security/research/tra-2024-13 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4548 – Delta Electronics DIAEnergie SQL Injection
https://notcve.org/view.php?id=CVE-2024-4548
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field. Existe una vulnerabilidad SQLi en Delta Electronics DIAEnergie v1.10.1.8610 y anteriores cuando CEBC.exe procesa un mensaje 'RecalculateHDMWYC', que se divide en 4 campos utilizando el carácter '~' como separador. Un atacante remoto no autenticado puede ejecutar SQLi a través del cuarto campo. • https://www.tenable.com/security/research/tra-2024-13 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4547 – Delta Electronics DIAEnergie Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2024-4547
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field Existe una vulnerabilidad SQLi en Delta Electronics DIAEnergie v1.10.1.8610 y anteriores cuando CEBC.exe procesa un mensaje 'RecalculateScript', que se divide en 4 campos utilizando el carácter '~' como separador. Un atacante remoto no autenticado puede ejecutar SQLi a través del cuarto campo • https://www.tenable.com/security/research/tra-2024-13 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28029 – Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie
https://notcve.org/view.php?id=CVE-2024-28029
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality. Los privilegios no se verifican completamente en el lado del servidor, lo que puede ser abusado por un usuario con privilegios limitados para eludir la autorización y acceder a funciones privilegiadas. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12 • CWE-285: Improper Authorization CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0822 – Improper Authorization
https://notcve.org/view.php?id=CVE-2023-0822
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06 • CWE-285: Improper Authorization CWE-552: Files or Directories Accessible to External Parties •