Delta DIAEnergie CVE-2026-78317

Exploitation requires a valid low-privilege account on the DIAEnergie application (confirmed by CVSS PR:L). The application must be network-reachable by the attacker (AV:N, AC:L). No user interaction from a victim is required (UI:N). The scope is unchanged (S:U), meaning exploitation is confined to the DIAEnergie host itself. Limiting factors: an attacker without any DIAEnergie credentials cannot exploit this remotely; default or weak credentials would satisfy the PR:L requirement and should be treated as a heightened risk. No specific non-default configuration is described as a prerequisite - the flaw appears to exist in core functionality. The OT/ICS deployment context limits prevalence of internet-exposed instances, but internal network or VPN access is a realistic attacker position in industrial environments.

The CVSS 3.1 score of 8.8 (High) reflects network accessibility, low attack complexity, low privilege requirement, and full confidentiality, integrity, and availability impact. The PR:L metric is significant: exploitation is gated behind authentication, which meaningfully reduces the exposed attack surface compared to unauthenticated (PR:N) vectors, but insider threats, stolen credentials, or default credential abuse all satisfy this prerequisite. No EPSS data was provided in the source intelligence; without it, probabilistic exploitation likelihood cannot be independently stated. No KEV listing is present, and no POC is referenced, so no confirmed active exploitation is known. The combination of network reachability, low complexity, and RCE impact makes this a genuine remediation priority for any organization running DIAEnergie - particularly given the OT/ICS deployment context where operational disruption is a material concern. The absence of a named fixed version in the available data is a data gap that should be resolved by consulting the vendor advisory directly before finalizing remediation planning.

An attacker with any valid low-privilege account on the DIAEnergie platform sends a crafted HTTP request containing a malicious SQL payload to a vulnerable application endpoint. The unsanitized input is executed within the database engine, which is then leveraged to spawn OS-level commands - for example via a stored procedure or linked server capability - resulting in arbitrary code execution under the database service account on the DIAEnergie server. No public POC has been identified at time of analysis, but the straightforward nature of the attack chain (authenticated SQL injection to RCE) is well-understood and reproducible by moderately skilled attackers.