No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Michael Heinzl
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-43699 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 9.8 Critical |
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product. Vendor fix: Delta recommends users update to DIAEnergie v1.10.01.009. Users can request this version of DIAEnergie from Delta Electronics' regional sales or agents. ↗ Mitigation: For more information on this issue, please see the Delta product cybersecurity advisory. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-42417 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8.8 High |
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product. Vendor fix: Delta recommends users update to DIAEnergie v1.10.01.009. Users can request this version of DIAEnergie from Delta Electronics' regional sales or agents. ↗ Mitigation: For more information on this issue, please see the Delta product cybersecurity advisory. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-43699 | 9.8 Critical | Delta Electronics DIAEnergie Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit th… |
| CVE-2024-42417 | 8.8 High | Delta Electronics DIAEnergie Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this … |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.