DIAEnergie CVE-2026-78311

Requires a valid low-privileged authenticated session on the DIAEnergie web application (PR:L) reachable over the network; no user interaction is needed. The exact vulnerable input is not disclosed in the advisory, so defenders cannot pin the injection to a specific feature or endpoint from available data. The primary limiting factor is the authentication requirement - an attacker must already possess or obtain valid credentials, though this barrier is weakened where DIAEnergie is exposed and where the companion auth-bypass (CVE-2026-78308) from the same PCSA-2026-00014 batch could supply access. Upgrading to DIAEnergie 1.11.00.022 or later remediates the issue.

This is a genuine, actionable priority for organizations running DIAEnergie, though not a drop-everything emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with a classic CWE-89 flaw where an authenticated application user can escalate to full database compromise. However, several risk-tempering signals are missing: there is NO EPSS score provided, the CVE is NOT on the CISA KEV list, and no public exploit code (POC) has been identified. Exploitation status is therefore 'no public exploit identified at time of analysis' - do not treat this as actively exploited. The single-source, self-reported nature (Delta's own PCSA advisory) means CVSS is vendor-assigned and not independently corroborated by NVD analysis. Net: the technical severity is real and the 8.8 is defensible, but the PR:L requirement (a valid low-privileged account) plus the lack of exploitation evidence places this as high-but-not-critical operational risk, weighted by the fact that DIAEnergie is deployed in industrial/energy environments where such compromise can affect operational data. DIAEnergie has a history of frequent SQL injection findings and prior CISA ICS advisories, which raises the baseline likelihood that a working exploit will eventually surface.

An attacker with a valid low-privilege DIAEnergie account (or one obtained via a companion flaw such as the auth-bypass CVE-2026-78308 in the same advisory batch) sends a crafted HTTP request containing malicious SQL through a vulnerable parameter. The injected query executes against the backend database, letting the attacker read, modify, or destroy stored energy-management data and potentially achieve deeper system access. No public exploit code is currently available, but the low attack complexity makes weaponization straightforward once endpoint details are known.