CVE-2022-3214 Delta Electronics DIAEnergy Use of Hard-coded Credentials
Attackers can upload executable files to Delta DIAEnergy using hard-coded credentials, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3214?
CVE-2022-3214 is a critical vulnerability in Deltaww Diaenergie, published on 16 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to
1.9.03.009
have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execution.
Weakness: CWE-798
Which versions are affected by CVE-2022-3214?
It affects 1 product.
Products include Deltaww Diaenergie.
How do I fix CVE-2022-3214?
No fix has been published for CVE-2022-3214 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3214 being exploited?
There is no known exploitation of CVE-2022-3214 in the wild and no public exploit code.
Other vulnerabilities in Deltaww Diaenergie
- CVE-2024-4547 Delta Electronics DIAEnergie Unauthenticated SQL Injection
- CVE-2024-4548 Delta Electronics DIAEnergie SQL Injection
- CVE-2022-43774 SQL injection in Delta Electronics DIAEnergie
- CVE-2022-43775 SQL injection in Delta Electronics DIAEnergie
- CVE-2022-1366 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx.
Sources
Also known as GHSA-jffp-ghx6-2288.