Delta DIAEnergie CVE-2026-78314

Exploitation requires a valid low-privileged user account on the DIAEnergie platform - confirmed by CVSS PR:L; unauthenticated exploitation is not supported by the available vector. The attack is network-accessible (AV:N) with no user interaction (UI:N) and low complexity (AC:L), meaning no special environmental configuration beyond holding a valid session is needed. The RCE escalation beyond SQL injection is conditioned on the database backend supporting OS command execution features such as SQL Server's xp_cmdshell; if this feature is disabled at the database tier, exploitation may be limited to unauthorized data read/write rather than full OS-level code execution. Exploitation is bounded to DIAEnergie versions at or below v1.11.00.002; the scope metric S:U indicates no inherent lateral scope change within the base exploit chain.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible flaw with low attack complexity and low privilege requirements, yielding full confidentiality, integrity, and availability impact via confirmed RCE. The PR:L designation indicates some authenticated access is required - a meaningful but not prohibitive barrier in ICS environments where default, shared, or weakly managed credentials are prevalent. No EPSS score was provided in the available data, which is a gap that limits probabilistic exploitation modeling; this should be checked against current NVD or FIRST data. The CVE does not appear in CISA KEV and no public POC has been identified at time of analysis, suggesting exploitation has not yet been observed at scale. Despite this, the combination of network vector, low complexity, and RCE capability in an OT-adjacent energy management platform represents high operational risk: even organizations operating with limited security resources should treat this as a priority patch given the potential for disruption to energy monitoring and control functions. SSVC signals suggest the automatable dimension is likely yes - the network-reachable, low-complexity vector requires no environmental setup - and technical impact is total given OS-level code execution.

An attacker with a low-privileged DIAEnergie user account sends a crafted HTTP request to the application, embedding SQL injection payloads in a vulnerable query parameter. The injected SQL manipulates the backend database to invoke OS-level command execution (e.g., via SQL Server xp_cmdshell), achieving remote code execution under the database service account's privileges. From this foothold, the attacker can exfiltrate energy management data, alter operational configurations, or pivot further into the OT network.