PT-2021-20001 · Delta Electronics · Diaenergie

Published 2021-08-30 · Updated 2022-07-02 · CVE-2021-32967

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior

Description The issue allows an attacker to add a new administrative user without being authenticated or authorized, potentially enabling the attacker to log in and use the device with administrative privileges.

Recommendations For Delta Electronics DIAEnergie versions 1.7.5 and prior, update to a version later than 1.7.5 to prevent unauthorized addition of administrative users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2021-32967

Affected Products

Diaenergie

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-32967 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32967 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03 · Note
• https://t.me/cvenotify/20633 · Telegram Post
• https://t.me/cibsecurity/28034 · Telegram Post