CVE-2024-4548
CRITICALDIAEnergie SQL Injection (CVE-2024-4548)
Title source: metasploitDescription
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
Exploits (1)
metasploit
WORKING POC
EXCELLENT
by Michael Heinzl, Tenable · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/diaenergie_sqli.rb
Scores
CVSS v3
9.8
EPSS
0.4502
EPSS Percentile
97.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
CWE-89
Status
published
Products (1)
deltaww/diaenergie
< 1.10.01.004
Published
May 06, 2024
Tracked Since
Feb 18, 2026