Delta DIAEnergie EUVD-2026-85822

No special conditions - remote unauthenticated exploitation is possible against DIAEnergie instances before 1.11.00.022, per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires only network reachability to the DIAEnergie web application; no authentication, no user interaction, and no non-default configuration are stated as prerequisites. The primary limiting factor is exposure scope: DIAEnergie is a niche ICS energy-management product typically deployed on segmented industrial/enterprise networks, so realistic risk hinges on whether the management interface is reachable from an attacker-controlled network. The exact vulnerable endpoint/parameter is not disclosed in the available data.

This is a genuinely high-risk vulnerability by its intrinsic characteristics, though real-world exploitation signals are thin. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1) describes remote, unauthenticated, low-complexity path traversal with no user interaction - the easiest-to-reach profile that exists. Notably C:N with I:H/A:H indicates this traversal enables arbitrary file WRITE/overwrite/deletion (integrity and availability) rather than file read/disclosure, consistent with an upload or write-path traversal in a web-facing management application. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so status is 'no public exploit identified at time of analysis' - the score reflects potential severity, not observed activity. The single reference is a self-published Delta advisory PDF (Delta-PCSA-2026-00014) covering a batch of vulnerabilities (CVE-2026-78308~78313), so the finding is vendor-reported and not independently corroborated by NVD analysis or a third-party researcher. DIAEnergie's ICS/energy-management niche means the exposed population is small, which argues against opportunistic mass exploitation; however, such systems have historically drawn targeted attention and Delta DIAEnergie has been the subject of repeated CISA ICS advisories, so internet-exposed instances should be patched promptly.

A remote, unauthenticated attacker sends a crafted HTTP request to an internet- or network-exposed DIAEnergie endpoint, embedding directory-traversal sequences (e.g. ../) in a file path parameter to write or overwrite files outside the intended directory. This can corrupt application/configuration files or plant a file in a web-executable location, damaging integrity and availability. No public exploit code is identified at time of analysis, but the low-complexity, no-auth vector makes weaponization straightforward.