Delta Electronics DIAEnergie

Vulnerability

The InsertReg API in Delta Electronics DIAEnergie versions prior to v1.9.01.002 does not properly neutralize user input, leading to a stored cross-site scripting vulnerability [1]. An attacker can inject malicious scripts that are stored and later executed in the context of authenticated users who access the affected application.

Exploitation

An attacker with low-privilege network access to the DIAEnergie application can craft a malicious payload and send it via the InsertReg API [1]. The payload is stored on the server. When a victim user, such as an administrator, views the page containing the injected script, the script executes in the victim's browser.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to disclosure of sensitive information, modification of data, and potential further compromise of the system [1]. The CVSS v3 base score is 8.8 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) [1].

Mitigation

Delta Electronics has released version v1.9.01.002 and later versions that fix this vulnerability. Users should update to v1.9.03.001 or newer as recommended in the advisory [1]. No workarounds are provided.