cnvd - cnvd-2022-27553

CNVD-2022-27553

Vulnerability from cnvd - Published: 2022-04-11

Title

Delta Electronics DIAEnergie授权问题漏洞

Description

Delta Electronics DIAEnergie是一个工业能源管理系统，用于实时监控和分析能源消耗、计算能源消耗和负载特性、优化设备性能、改进生产流程并最大限度地提高能源效率。 Delta Electronics DIAEnergie存在授权问题漏洞，该漏洞源于受到DIAEnergie应用程序中不正确的默认权限的攻击。攻击者可利用该漏洞植入新文件（如DLL）或替换现有的可执行文件。

Severity

中

Patch Name

Delta Electronics DIAEnergie授权问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.deltaww.com/en-US/index

Reference

https://us-cert.cisa.gov/ics/advisories/icsa-22-081-01

Impacted products

Name
Delta Electronics DIAEnergie <=1.8.02.004

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-26839",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-26839"
    }
  },
  "description": "Delta Electronics DIAEnergie\u662f\u4e00\u4e2a\u5de5\u4e1a\u80fd\u6e90\u7ba1\u7406\u7cfb\u7edf\uff0c\u7528\u4e8e\u5b9e\u65f6\u76d1\u63a7\u548c\u5206\u6790\u80fd\u6e90\u6d88\u8017\u3001\u8ba1\u7b97\u80fd\u6e90\u6d88\u8017\u548c\u8d1f\u8f7d\u7279\u6027\u3001\u4f18\u5316\u8bbe\u5907\u6027\u80fd\u3001\u6539\u8fdb\u751f\u4ea7\u6d41\u7a0b\u5e76\u6700\u5927\u9650\u5ea6\u5730\u63d0\u9ad8\u80fd\u6e90\u6548\u7387\u3002\n\nDelta Electronics DIAEnergie\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5230DIAEnergie\u5e94\u7528\u7a0b\u5e8f\u4e2d\u4e0d\u6b63\u786e\u7684\u9ed8\u8ba4\u6743\u9650\u7684\u653b\u51fb\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u690d\u5165\u65b0\u6587\u4ef6\uff08\u5982DLL\uff09\u6216\u66ff\u6362\u73b0\u6709\u7684\u53ef\u6267\u884c\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.deltaww.com/en-US/index",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-27553",
  "openTime": "2022-04-11",
  "patchDescription": "Delta Electronics DIAEnergie\u662f\u4e00\u4e2a\u5de5\u4e1a\u80fd\u6e90\u7ba1\u7406\u7cfb\u7edf\uff0c\u7528\u4e8e\u5b9e\u65f6\u76d1\u63a7\u548c\u5206\u6790\u80fd\u6e90\u6d88\u8017\u3001\u8ba1\u7b97\u80fd\u6e90\u6d88\u8017\u548c\u8d1f\u8f7d\u7279\u6027\u3001\u4f18\u5316\u8bbe\u5907\u6027\u80fd\u3001\u6539\u8fdb\u751f\u4ea7\u6d41\u7a0b\u5e76\u6700\u5927\u9650\u5ea6\u5730\u63d0\u9ad8\u80fd\u6e90\u6548\u7387\u3002\r\n\r\nDelta Electronics DIAEnergie\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5230DIAEnergie\u5e94\u7528\u7a0b\u5e8f\u4e2d\u4e0d\u6b63\u786e\u7684\u9ed8\u8ba4\u6743\u9650\u7684\u653b\u51fb\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u690d\u5165\u65b0\u6587\u4ef6\uff08\u5982DLL\uff09\u6216\u66ff\u6362\u73b0\u6709\u7684\u53ef\u6267\u884c\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Delta Electronics DIAEnergie\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Delta Electronics DIAEnergie \u003c=1.8.02.004"
  },
  "referenceLink": "https://us-cert.cisa.gov/ics/advisories/icsa-22-081-01",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-24",
  "title": "Delta Electronics DIAEnergie\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2022-26839 (GCVE-0-2022-26839)

Vulnerability from cvelistv5 – Published: 2022-03-29 16:37 – Updated: 2025-04-16 17:58

Summary

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-276 - Incorrect Default Permissions

Assigner

icscert

References

URL

Tags

https://www.cisa.gov/uscert/ics/advisories/icsa-2…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Delta Electronics	DIAEnergie	Affected: unspecified , < 1.8.02.004 (custom)

Credits

Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:11:44.493Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-26839",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T17:30:38.498995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:58:28.610Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DIAEnergie",
          "vendor": "Delta Electronics",
          "versions": [
            {
              "lessThan": "1.8.02.004",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Michael Heinzl and Dusan Stevanovic of Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2022-03-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-29T16:37:14.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.\n\nDelta also suggests users:\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.\nLocate control system networks and remote devices behind firewalls and isolate them from the business network.\nUse an application firewall that can detect attacks against \u201cPath Traversal\u201d and \u201cSQL Injection\u201d weakness.\nNever connect programming software to any network other than the network intended for that device.\nWhen remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing a VPN is only as secure as its connected devices"
        }
      ],
      "source": {
        "advisory": "ICSA-22-081-01",
        "discovery": "UNKNOWN"
      },
      "title": "Delta Electronics DIAEnergie Incorrect Default Permissions",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-03-22T18:52:00.000Z",
          "ID": "CVE-2022-26839",
          "STATE": "PUBLIC",
          "TITLE": "Delta Electronics DIAEnergie Incorrect Default Permissions"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DIAEnergie",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.8.02.004"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Delta Electronics"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Michael Heinzl and Dusan Stevanovic of Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-276 Incorrect Default Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01",
              "refsource": "CONFIRM",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.\n\nDelta also suggests users:\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.\nLocate control system networks and remote devices behind firewalls and isolate them from the business network.\nUse an application firewall that can detect attacks against \u201cPath Traversal\u201d and \u201cSQL Injection\u201d weakness.\nNever connect programming software to any network other than the network intended for that device.\nWhen remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing a VPN is only as secure as its connected devices"
          }
        ],
        "source": {
          "advisory": "ICSA-22-081-01",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-26839",
    "datePublished": "2022-03-29T16:37:14.522Z",
    "dateReserved": "2022-03-14T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:58:28.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-27553

CVE-2022-26839 (GCVE-0-2022-26839)

Tags

Sightings

Nomenclature