CVE-2022-43457: Delta Electronics DIAEnergie SQL Injection

Q: What is the CVE ID for this vulnerability?

The CVE ID for this vulnerability is CVE-2022-43457.

Q: What is the severity of CVE-2022-43457?

The severity of CVE-2022-43457 is high with a CVSS score of 8.8.

Q: What is the CWE ID for this vulnerability?

The CWE ID for this vulnerability is CWE-89.

Q: How can I fix CVE-2022-43457?

To fix CVE-2022-43457, it is recommended to upgrade Delta Electronics DIAEnergie to version v1.9.02.001 or later.

Published Nov 17, 2022

Updated

SQL Injection in

HandlerPageKID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

Affected Software

3 affected components

Delta Electronics DIAEnergie versions prior to v1.9.01.002

Delta Electronics DIAEnergie versions prior to v1.9.02.001

Deltaww Diaenergie<1.9.02.001

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Delta Electronics DIAEnergie to a version that resolves this vulnerability.
Fixed in v1.9.02.001
Compensating control
Since Delta did not publicly release v1.9.01.002 or v1.9.02.001 in the material, contact Delta Electronics to receive the update packages for HandlerPage_KID.ashx SQL injection.

Event History

Nov 17, 2022

CVE Published

via MITRE·10:45 PM

Data Sourced

via MITRE·10:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-298-06

Frequently Asked Questions

What is the CVE ID for this vulnerability?

The CVE ID for this vulnerability is CVE-2022-43457.

What is the severity of CVE-2022-43457?

The severity of CVE-2022-43457 is high with a CVSS score of 8.8.

Which software versions are affected by this vulnerability?

Delta Electronics DIAEnergie versions prior to v1.9.02.001 are affected by this vulnerability.

What is the CWE ID for this vulnerability?