CVE-2022-1370: SQL Injection
Published May 2, 2022
·Updated
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Affected Software
2 affected componentsFixes available
Delta Electronics DIAEnergie<1.9
1.9
Deltaww Diaenergie<1.8.02.004
Remediation
Information
Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.
Event History
May 2, 2022
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-1370.
2
What is the affected software?
The affected software is Delta Electronics DIAEnergie (versions prior to 1.8.02.004).
3
What is the severity of CVE-2022-1370?
The severity of CVE-2022-1370 is critical with a CVSS score of 9.8.
4
What is the CWE category for this vulnerability?
The CWE category for this vulnerability is CWE-89 (SQL Injection).
5
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by injecting arbitrary SQL queries, retrieving and modifying database contents, and executing system commands.