EUVD-2026-64760
GHSA-44c5-xccp-32vq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible web interface justifies AV:N/AC:L; low-privilege credential required per exploitation conditions yields PR:L; RCE with full system access justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
AnalysisAI
SQL Injection in Delta Electronics DIAEnergie versions up to and including 1.11.00.002 enables a low-privileged remote attacker to achieve full remote code execution on the underlying server. Confirmed by vendor advisory Delta-PCSA-2026-00015 and ENISA EUVD-2026-64760, the flaw (CWE-89) stems from unsanitized user input passed directly to backend SQL queries, with the database engine serving as the execution bridge to the OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid low-privilege account on the DIAEnergie application, consistent with CVSS PR:L - unauthenticated exploitation is not indicated by available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable, low-complexity flaw requiring only a low-privilege credential, with full confidentiality, integrity, and availability impact - a score of 8.8 (High) is appropriate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privilege DIAEnergie account - via phishing, credential reuse, or default credentials - sends a crafted HTTP request with SQL injection payloads embedded in a vulnerable application parameter. The unsanitized input manipulates the backend SQL query, enabling stacked queries or abuse of database-native command execution features to run arbitrary operating system commands as the database service account. … |
| Remediation | Consult Delta Electronics advisory Delta-PCSA-2026-00015 at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00015_DIAEnergie%20SQL%20Injection%20Vulberabilities_v1.0.pdf for the vendor-released patch and exact fixed version number; a specific patched release version is not independently confirmed from the provided input data and should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running DIAEnergie versions 1.11.00.002 or earlier, isolate affected systems or restrict network access to trusted administrative sources only, and activate incident response monitoring for suspicious database queries or unexpected process execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Diaenergie
View allAn SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalcula
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalculat
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. Rated high severity (CV
A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1
SQL injection vulnerability exists in GetDIAE_usListParameters. Rated critical severity (CVSS 9.8), this vulnerability i
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to ga
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacke
Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-c
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_r
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_s
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today