CVE-2021-38418

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.

Score

CVSS 3.1 8.8 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2021-11-03

Last modified

2024-09-16

Weaknesses

CWE-319

Affected products

• Dialink (Delta Electronics)
• Dialink (Deltaww)

References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02