DIAEnergie EUVD-2026-64760

Exploitation requires possession of a valid low-privilege account on the DIAEnergie application, consistent with CVSS PR:L - unauthenticated exploitation is not indicated by available data. The attack is network-accessible (AV:N) over the DIAEnergie web interface and requires no additional user interaction beyond the attacker's own requests (UI:N). No special non-default application configuration is described as a prerequisite, meaning any standard DIAEnergie deployment running version 1.11.00.002 or earlier with a network-reachable interface is potentially vulnerable once a low-privilege credential is obtained. Exploitation is meaningfully limited by the credential requirement (PR:L) and by any network segmentation isolating the DIAEnergie server from untrusted networks; air-gapped or tightly segmented OT environments substantially reduce exploitability despite the network-vector classification.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable, low-complexity flaw requiring only a low-privilege credential, with full confidentiality, integrity, and availability impact - a score of 8.8 (High) is appropriate. No EPSS score is available in the provided data, and the CVE is absent from the CISA KEV catalog, so active exploitation is not confirmed. No POC code has been identified. The PR:L requirement raises the bar above fully unauthenticated attacks but does not substantially mitigate risk in targeted scenarios where default credentials, credential stuffing, or phishing can satisfy the prerequisite. The industrial (OT/ICS) deployment context amplifies real-world impact: RCE on an energy management server could disrupt visibility into energy systems or enable lateral movement into adjacent OT networks. The absence of EPSS data and KEV listing is a gap - prioritization should lean on the network-accessible RCE impact rather than exploitation probability signals, which are currently unavailable.

An attacker who has obtained a low-privilege DIAEnergie account - via phishing, credential reuse, or default credentials - sends a crafted HTTP request with SQL injection payloads embedded in a vulnerable application parameter. The unsanitized input manipulates the backend SQL query, enabling stacked queries or abuse of database-native command execution features to run arbitrary operating system commands as the database service account. No public proof-of-concept code has been identified at time of analysis, but the technique is well-understood and widely documented for ICS/SCADA web applications using similar SQL backends.