Delta DIAEnergie RCE via Path Traversal, SQLi (ICSA-22-081-01)

Critical Vulnerability Information 1. Summary Vulnerability Title: Delta Electronics DIAEnergie (Update C) Revision Date: August 02, 2022 Alert Code: ICSA-22-081-01 CVSS v3 Score: 9.8 2. Vulnerability Details Remotely Exploitable: Yes Attack Complexity: Low Vendor: Delta Electronics Affected Devices: DIAEnergie Vulnerability Types: - Path Traversal - Incorrect Default Permissions - SQL Injection - Uncontrolled Search Path Element 3. Risk Assessment Consequences of Successful Exploitation: Remote code execution, potentially leading to unintended operations by users. 4. Technical Details Affected Products: All versions of DIAEnergie prior to 1.9 Vulnerability Overview: - Path Traversal (CVE-2022-25347): Allows attackers to write arbitrary files to any location in the file system. - Incorrect Default Permissions (CVE-2022-26839): May allow attackers to implant new files or replace existing executable files. - Multiple SQL Injection Vulnerabilities: Enable attackers to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. 5. Background Information Critical Infrastructure Sector: Wholesale Manufacturing Deployed Countries/Regions: Global Company Headquarters Location: Taiwan 6. Researchers Reporters: Michael Heinzl and Dusan Stevanovic of Trend Micro's Zero Day Initiative 7. Mitigation Vendor Recommendation: Upgrade to version 1.9 or later 8. Additional Recommendations Minimize network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. Place control system networks and remote devices behind firewalls and isolate them from enterprise networks. Use application firewalls capable of detecting "path traversal" and "SQL injection" vulnerabilities. Never connect programming software to any network outside the intended network for the device. When remote access is required, use secure methods such as Virtual Private Networks (VPNs), and remember that a VPN is only as secure as the devices it connects to.

Goal Reached Thanks to every supporter — we hit 100%!

Delta DIAEnergie RCE via Path Traversal, SQLi (ICSA-22-081-01)