DIAEnergie CVE-2026-78309

Requires valid low-privileged authenticated access to the DIAEnergie web application (CVSS PR:L), reachable over the network (AV:N) with no user interaction. Exploitation targets versions before 1.11.00.022; instances patched to 1.11.00.022 or later are not affected. The limiting factor is the need for credentials - this is not an unauthenticated flaw - but any authenticated account, however low-privileged, appears sufficient given PR:L. The exact vulnerable parameter/endpoint is not specified in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact on the backend database. This is internally consistent with the CWE-89 classification and the terse 'SQL Injection vulnerability in DIAEnergie' description. However, several exploitation signals are entirely absent: no EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so the assessment is 'no public exploit identified at time of analysis.' The single reference is a Delta vendor advisory PDF (Delta-PCSA-2026-00014) bundling CVE-2026-78308 through 78313, confirming the vendor acknowledges and has patched the issue but providing no exploited-in-the-wild claim. Weighing signals: the high CVSS reflects genuine technical impact, but the PR:L requirement means an attacker needs valid (even low-privileged) credentials, which meaningfully narrows the exposure versus a fully unauthenticated flaw. DIAEnergie is an industrial energy-management platform historically targeted in prior CISA ICS advisories, so authenticated SQLi is a credible priority for operators who expose the web interface, but there is no evidence of active or automated exploitation at this time. Missing data to note explicitly: EPSS, KEV, and POC status are all absent - treat exploitation likelihood as unquantified rather than low.

An attacker holding low-privileged credentials to a DIAEnergie web instance submits a crafted parameter containing malicious SQL to a vulnerable endpoint, which is concatenated unsanitized into a backend query. This lets them read, alter, or delete energy-monitoring and configuration data across the database, and potentially escalate toward the underlying host depending on database privileges. No public proof-of-concept was identified, and exploitation requires prior authentication.