Diascreen
Monthly
An out-of-bounds write in Delta Electronics DIAScreen before 1.6.1 lets attackers execute code in the context of the current process when a victim opens a specially crafted project file. The flaw is a file-parsing validation failure (CWE-787) that is strictly client-side: exploitation is local (AV:L) and requires the operator to actively open a malicious file, so there is no remote or unattended attack path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 3rd percentile), making real-world risk low despite the code-execution potential.
An out-of-bounds write in the file-parsing routine of Delta Electronics DIAScreen (all versions prior to 1.6.1) allows code execution in the context of the current DIAScreen process when a user opens an attacker-crafted project file. The CVSS v4.0 vector is local (AV:L) with PR:N - unauthenticated - but requires active user interaction (UI:A), so the attacker must first deliver a malicious file to an engineering workstation and convince an operator to open it; there is no remote or network-triggered path. No public exploit code has been identified at time of analysis (no CISA KEV listing), and the EPSS score is only 0.02% (3rd percentile), which aligns with our independent assessment that this is a moderate, not high-priority, issue for most environments, though the high availability impact (memory corruption/crash) makes even failed exploitation disruptive on production engineering hosts.
An out-of-bounds write in Delta Electronics DIAScreen's file-parsing routine (all versions from 0 through 1.6.1) allows an attacker to execute code in the context of the current user's process when an engineer or operator opens a crafted project/configuration file. The flaw is exploitable without authentication (CVSS 4.0 vector PR:N) but is strictly local and requires the victim to be socially engineered into opening the malicious file (UI:A), so there is no drive-by, network-reachable, or self-propagating path, and impact stays bounded to the victim's own privileges (S:U, SC:N/SI:N/SA:N). Risk signals point to low real-world urgency: EPSS is only 0.02% (3rd percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis. Delta has released a vendor patch in DIAScreen 1.6.1.
An out-of-bounds write in the file-parsing routines of Delta Electronics DIAScreen (versions prior to 1.6.1) allows a crafted project file to corrupt memory and execute code in the context of the DIAScreen process when a user opens it. Exploitation is local and user-interaction driven: the attacker must deliver a malicious file and induce the victim to open it, so social engineering, not network reachability, is the limiting factor - no pre-existing credentials in the application are needed (PR:N in the assessed vector), but the attack hinges on a user opening the file (UI:A, UI:R in the CVSS 3.1 assessment). Delta has published a fixed build (1.6.1), EPSS is 0.02% (3rd percentile), and no public exploit code has been identified at time of analysis.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Delta Electronics DIAScreen before 1.6.1 lets attackers execute code in the context of the current process when a victim opens a specially crafted project file. The flaw is a file-parsing validation failure (CWE-787) that is strictly client-side: exploitation is local (AV:L) and requires the operator to actively open a malicious file, so there is no remote or unattended attack path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 3rd percentile), making real-world risk low despite the code-execution potential.
An out-of-bounds write in the file-parsing routine of Delta Electronics DIAScreen (all versions prior to 1.6.1) allows code execution in the context of the current DIAScreen process when a user opens an attacker-crafted project file. The CVSS v4.0 vector is local (AV:L) with PR:N - unauthenticated - but requires active user interaction (UI:A), so the attacker must first deliver a malicious file to an engineering workstation and convince an operator to open it; there is no remote or network-triggered path. No public exploit code has been identified at time of analysis (no CISA KEV listing), and the EPSS score is only 0.02% (3rd percentile), which aligns with our independent assessment that this is a moderate, not high-priority, issue for most environments, though the high availability impact (memory corruption/crash) makes even failed exploitation disruptive on production engineering hosts.
An out-of-bounds write in Delta Electronics DIAScreen's file-parsing routine (all versions from 0 through 1.6.1) allows an attacker to execute code in the context of the current user's process when an engineer or operator opens a crafted project/configuration file. The flaw is exploitable without authentication (CVSS 4.0 vector PR:N) but is strictly local and requires the victim to be socially engineered into opening the malicious file (UI:A), so there is no drive-by, network-reachable, or self-propagating path, and impact stays bounded to the victim's own privileges (S:U, SC:N/SI:N/SA:N). Risk signals point to low real-world urgency: EPSS is only 0.02% (3rd percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis. Delta has released a vendor patch in DIAScreen 1.6.1.
An out-of-bounds write in the file-parsing routines of Delta Electronics DIAScreen (versions prior to 1.6.1) allows a crafted project file to corrupt memory and execute code in the context of the DIAScreen process when a user opens it. Exploitation is local and user-interaction driven: the attacker must deliver a malicious file and induce the victim to open it, so social engineering, not network reachability, is the limiting factor - no pre-existing credentials in the application are needed (PR:N in the assessed vector), but the attack hinges on a user opening the file (UI:A, UI:R in the CVSS 3.1 assessment). Delta has published a fixed build (1.6.1), EPSS is 0.02% (3rd percentile), and no public exploit code has been identified at time of analysis.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.