ID
VAR-202405-0030
CVE
CVE-2024-4548
TITLE
Delta Electronics, INC. of DIAEnergie In SQL Injection vulnerability
Trust: 0.8
DESCRIPTION
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field. Delta Electronics, INC. of DIAEnergie for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, a Taiwanese company, used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency. Delta Electronics DIAEnergie v1.10.1.8610 and earlier versions have a SQL injection vulnerability
Trust: 2.16
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | deltaww | model: | diaenergie | scope: | lt | version: | 1.10.01.004 | Trust: 1.0 |
| vendor: | delta | model: | diaenergie | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | delta | model: | diaenergie | scope: | eq | version: | 1.10.01.004 | Trust: 0.8 |
| vendor: | delta | model: | diaenergie | scope: | - | version: | - | Trust: 0.8 |
| vendor: | delta | model: | electronics delta electronics diaenergie | scope: | lte | version: | <=1.10.1.8610 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-89 | Trust: 1.0 |
| problemtype: | CWE-20 | Trust: 1.0 |
| problemtype: | Inappropriate input confirmation (CWE-20) [ others ] | Trust: 0.8 |
| problemtype: | SQL injection (CWE-89) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | Patch for Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2024-29663) | url: | https://www.cnvd.org.cn/patchInfo/show/563801 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-4548 | Trust: 3.2 |
| db: | TENABLE | id: | TRA-2024-13 | Trust: 2.4 |
| db: | JVNDB | id: | JVNDB-2024-025529 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-29663 | Trust: 0.6 |
REFERENCES
| url: | https://www.tenable.com/security/research/tra-2024-13 | Trust: 2.4 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-4548 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2024-29663 |
| db: | JVNDB | id: | JVNDB-2024-025529 |
| db: | NVD | id: | CVE-2024-4548 |
LAST UPDATE DATE
2025-07-04T23:31:37.699000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-29663 | date: | 2024-06-28T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-025529 | date: | 2025-07-01T07:19:00 |
| db: | NVD | id: | CVE-2024-4548 | date: | 2025-06-27T14:44:50.180 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-29663 | date: | 2024-06-28T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-025529 | date: | 2025-07-01T00:00:00 |
| db: | NVD | id: | CVE-2024-4548 | date: | 2024-05-06T14:15:08.533 |