CVE-2022-3214 CRITICAL

CVE-2022-3214: Delta Electronics DIAEnergy Use of Hard-coded Credentials

Vendor Delta Electronics
Product DIAEnergy
Weakness CWE-798 · Hardcoded credentials
Published September 16, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to  1.9.03.009 have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execution.

Key dates

02Disclosure timeline

September 16, 2022 CVE published
August 3, 2024 Record updated