CVE-2024-4549 Delta Electronics DIAEnergie SQL Injection
An attacker can cause a denial of service by triggering a system restart via a specific message in Delta Electronics DIAEnergie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4549?
CVE-2024-4549 is a high-severity denial of service vulnerability in Deltaww Diaenergie, published on 6 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
Weakness: CWE-400
Which versions are affected by CVE-2024-4549?
It affects 1 product.
Products include Deltaww Diaenergie.
How do I fix CVE-2024-4549?
No fix has been published for CVE-2024-4549 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-4549 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4549 exists.
Other vulnerabilities in Deltaww Diaenergie
- CVE-2024-4547 Delta Electronics DIAEnergie Unauthenticated SQL Injection
- CVE-2024-4548 Delta Electronics DIAEnergie SQL Injection
- CVE-2022-43774 SQL injection in Delta Electronics DIAEnergie
- CVE-2022-43775 SQL injection in Delta Electronics DIAEnergie
- CVE-2022-3214 Delta Electronics DIAEnergy Use of Hard-coded Credentials
Sources
Also known as GHSA-2252-jwp3-qxfh.