CVE-2022-26667

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

Score

CVSS 3.1 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2022-03-29

Last modified

2025-04-16

Weaknesses

CWE-89

Affected products

• Diaenergie (Delta Electronics)
• Diaenergie (Deltaww)

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01