CVE-2021-38390

2021-08-3017:33:30

CWE-89

icscert

www.cve.org

0.002 Low

EPSS

Percentile

61.4%

JSON

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.

CNA Affected

[
  {
    "product": "Delta Electronics DIAEnergie",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "DIAEnergie Version 1.7.5 and prior"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-21-238-03

0.002 Low

EPSS

Percentile

61.4%

JSON

Related for CVELIST:CVE-2021-38390