PT-2021-22115 · Delta Electronics · Dialink

Michael Heinzl · Published 2021-11-03 · Updated 2021-11-05 · CVE-2021-38411

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior

Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the deviceName parameter of the "modbusWriter-Reader" API, potentially enabling remote code execution.

Recommendations For Delta Electronics DIALink versions 1.2.4.0 and prior, consider disabling the modbusWriter-Reader API or restricting access to the deviceName parameter until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-38411

Affected Products

Dialink

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-38411 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38411 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02 · Note
• https://t.me/cibsecurity/31774 · Telegram Post