EUVD-2021-24868

Malware in sbrugna...

Delta Electronics DIALink Directory Traversal Authentication Bypass Vulnerability

This vulnerability allows remote attackers to overwrite configuration files on affected installations of Delta Electronics DIALink. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 7631 by default. The issue...

CVE-2025-58321

Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability...

CVE-2025-58320

Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability...

CVE-2025-58321: Improper Limitation of a Pathname to a Restricted Directory

Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability...

CVE-2025-58320: Improper Limitation of a Pathname to a Restricted Directory

Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability...

CVE-2021-38411

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code...

CVE-2021-38407

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code...

CVE-2021-38416

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed...

CVE-2021-38424

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application...

CVE-2021-38403 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code...

CVE-2021-38418

Delta Electronics DIALink (versions 1.2.4.0 and earlier) runs by default over HTTP, enabling potential machine-in-the-middle access to sensitive information. The CVE-2021-38418 issue is classified as high risk (CISA says 8.8/3.1) due to cleartext transmission of sensitive data. Affected component...

PT-2021-22121

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to inject formulas into the tag data through the tag interface. These formulas can then be executed when the data is opened with a spreadsheet...

PT-2021-22114

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the name parameter of the "API devices" endpoint, which may enable remote code execution...

PT-2021-22118

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to perform a machine-in-the-middle attack, accessing information without authorization because the software runs by default on HTTP. This enables the...

PT-2021-22115

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the deviceName parameter of the "modbusWriter-Reader" API, potentially enabling remote code...

PT-2021-22122

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the name parameter of the "API schedule" endpoint, which may enable remote code execution...

PT-2021-22119

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue concerns default permissions that give extensive access to low-privileged user accounts. This may allow an attacker to modify the installation directory and upload...

PT-2021-22117

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to potentially use DLL hijacking and takeover the system where the software is installed due to insecure library loading. Recommendations For Delta...

CVE-2021-38424: Improper Neutralization of Formula Elements in a CSV File

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application...