ICSA-22-298-06

Delta Electronics DIAEnergie

Advisory ansehen veröffentlicht 2022-11-10

This updated advisory is a follow-up to the original advisory titled ICSA-22-298-06 Delta Electronics DIAEnergie (Update A) that was published November 10, 2022, to the ICS webpage at www.cisa.gov/uscert.

beschreibt (14)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-0822US	high8.8	0.63% (50th)	—	2023-02-17
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileg…
CVE-2022-43506US	high8.8	0.77% (55th)	—	2022-11-17
SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-43457US	high8.8	0.69% (53rd)	—	2022-11-17
SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-43452US	high8.8	7.69% (95th)	—	2022-11-17
SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-43447US	high8.8	0.69% (53rd)	—	2022-11-17
SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-41775US	high8.8	0.69% (53rd)	—	2022-11-17
SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-41773US	high8.8	8.05% (95th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit…
CVE-2022-41702US	medium5.4	11.1% (96th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API.
CVE-2022-41701US	medium5.4	11.1% (96th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API.
CVE-2022-41651US	medium5.4	11.1% (96th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.
CVE-2022-41555US	medium5.4	11.1% (96th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API.
CVE-2022-41133US	high8.8	27.1% (98th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authen…
CVE-2022-40967US	high8.8	7.84% (95th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker coul…
CVE-2022-40965US	medium5.4	11.1% (96th)	—	2022-10-27
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Recommended Practicesexternal
ICS Advisory ICSA-22-298-06 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-22-298-06 Web Versionself
Recommended Practicesexternal

Behebungen (14)

MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.
MitigationDIAEnergie
Delta did not publicly release v1.9.01.002, v1.9.02.001, and v1.9.03.001, which address these vulnerabilities. Users are encouraged to contact Delta to receive these updates.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan