EUVD-2026-85823
GHSA-g97f-h4gm-v8mf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend request to access-controlled endpoint
-
ExecutionExploit missing authorization check
-
ImpactRead unauthorized sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the DIAEnergie web application (CVSS PR:L) and network reachability to the affected instance; exploitation is remote, low-complexity, and needs no user interaction. The limiting factor is the authentication requirement - an attacker must already hold at least low-privilege credentials, so it is not exploitable by fully anonymous internet scanning. Only versions before 1.11.00.022 are affected. Impact is confined to confidentiality (unauthorized read of sensitive data); no integrity or availability effect is claimed. The specific vulnerable feature/endpoint is not named in the vendor description. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) indicates a network-reachable improper-access-control flaw that a low-privileged authenticated user can trigger with low complexity and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with a broken authorization / IDOR-style data-exposure issue rather than a true pre-auth authentication bypass. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or automated exploitation. This places it as a real but moderate-priority patch item: it requires a valid (even low-tier) account, which shrinks the attacker population, and the confidentiality-only impact limits blast radius. The 'Authentication Bypass' tag conflicts with both the CWE-284 (improper access control/authorization) classification and the PR:L vector, which requires prior authentication - treat the tag as inaccurate. DIAEnergie is ICS/OT energy-management software historically named in recurring CISA ICS advisories, so exposed internet-facing instances warrant timely patching even absent confirmed exploitation. |
| Exploit ScenarioDerived | An authenticated low-privilege user of a DIAEnergie deployment sends crafted requests to an endpoint that fails to enforce per-object or per-role authorization, retrieving sensitive data belonging to other users or higher-privilege scopes. No user interaction or elevated privileges are needed, but a valid account and network reachability to the web application are required. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Improper access control in Delta Electronics DIAEnergie before 1.11.00.022 allows a low-privileged authenticated user to read sensitive data that should be restricted to higher-privilege roles, with network-reachable, low-complexity exploitation that requires no user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) shows the impact is confined to confidentiality - no integrity or availability effect - and the PR:L component means an attacker must already hold at least a valid low-privilege account on the web application rather than being a fully anonymous internet scanner. No public exploit code was identified at time of analysis and the vulnerability is not confirmed as actively exploited (not listed in CISA KEV), so risk is highest for environments where DIAEnergie is network-exposed and accounts are broadly provisioned.
RemediationAI
Apply the vendor fix by upgrading DIAEnergie to 1.11.00.022 or later - this is the exact version boundary given in the affected range - and consult Delta advisory PCSA-2026-00014 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf) for the bundled fixes covering CVE-2026-78308 through CVE-2026-78313. Because exploitation requires only a valid low-privilege account (CVSS PR:L), patching should be paired with credential hygiene: audit and disable unused or default DIAEnergie accounts, remove accounts that no longer need access, rotate passwords for remaining users, and review role assignments so that no account has more privilege than its function requires - the trade-off is administrative overhead and possible disruption if shared operator logins are widely used. Until patching is complete, restrict network reachability to the DIAEnergie web interface with firewall rules or network segmentation so that only trusted management/operator subnets can reach it; this materially reduces exposure but will break remote or vendor access paths that terminate outside those segments, so those paths must be explicitly enumerated first. Since the impact is read-only data disclosure (C:H with I:N/A:N), no integrity or availability compensating control is warranted, but if the specific exposed endpoint becomes known from the vendor bulletin, blocking or restricting it at a reverse proxy would be a targeted interim measure with the caveat that it may disable legitimately used reporting or dashboard features.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DIAEnergie is Delta Electronics' industrial energy management software, deployed on Windows hosts to collect, visualize and report power/energy consumption data from meters and PLCs across industrial and building-automation environments; it exposes a web application for operator access. The flaw is classified under CWE-284 (Improper Access Control), meaning the server-side code fails to enforce authorization on one or more resources or functions - the classic broken-object-level / broken-function-level authorization pattern where an authenticated session with low privileges can request resources belonging to other users, other tenants, or higher-privilege functionality and still receive the data. The PR:L/UI:N/S:U/C:H/I:N/A:N vector is fully consistent with this class: the attacker needs only a valid low-privilege login, the request is a straightforward HTTP call over the network with no race or memory-corruption complexity, and the outcome is unauthorized disclosure of sensitive configuration, meter, or operational data without modification of state. The CPE string cpe:2.3:a:deltaww:diaenergie:*:*:*:*:*:*:*:* confirms the identifier maps to the DIAEnergie application as a whole with a wildcard version, and the vendor bulletin groups this CVE with CVE-2026-78308 through CVE-2026-78313 as a set of multiple vulnerabilities in the same product. The specific vulnerable endpoint or feature is not named in the vendor's public description, so defenders cannot rely on function-level blocking without vendor guidance.
Know when Diaenergie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable web app, low complexity, requires a low-privilege authenticated account (PR:L), no interaction; confidentiality-only high impact per CWE-284 data exposure, no I/A effect.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
Lifecycle Timeline
1DescriptionCVE.org
Improper Access Control in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Diaenergie
View allAn SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalcula
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalculat
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. Rated high severity (CV
A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1
Improper authentication in Delta Electronics DIAEnergie before 1.11.00.022 allows authentication bypass, enabling remote
SQL injection vulnerability exists in GetDIAE_usListParameters. Rated critical severity (CVSS 9.8), this vulnerability i
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to ga
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacke
Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-c
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_r
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
Exploit-DB