CVE-2022-1367: SQL Injection

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2022-1367.

Q: What is the severity of CVE-2022-1367?

The severity of CVE-2022-1367 is critical with a CVSS score of 9.8.

Q: What is the affected software?

The affected software is Delta Electronics DIAEnergie, all versions prior to 1.8.02.004.

Q: What is the description of CVE-2022-1367?

CVE-2022-1367 is a blind SQL injection vulnerability that exists in Handler_TCV.ashx of Delta Electronics DIAEnergie, allowing attackers to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

Q: Is there a fix available for CVE-2022-1367?

Yes, updating to version 1.8.02.004 or later of Delta Electronics DIAEnergie resolves the vulnerability.

Published May 2, 2022

Updated

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTCV.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

Affected Software

2 affected componentsFixes available

Delta Electronics DIAEnergie<1.9

1.9

Deltaww Diaenergie<1.8.02.004

Remediation

Information

Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.

Event History

May 2, 2022

CVE Published

via MITRE·06:02 PM

Data Sourced

via MITRE·06:02 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-081-01

Frequently Asked Questions

What is the vulnerability ID?