Improper Authorization

Vulnerability

The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality. This vulnerability is present in all versions before the fixed release [1].

Exploitation

An attacker with network access to the DIAEnergie web interface can exploit this vulnerability without authentication. The low attack complexity and remote exploitability (CVSS v3 8.8) indicate that the attacker can send specially crafted requests to bypass authorization checks [1].

Impact

Successful exploitation allows an unauthorized attacker to access privileged functionality, potentially leading to arbitrary code execution, retrieval and modification of database contents, and execution of system commands. The CVSS vector indicates high impact on confidentiality and integrity [1].

Mitigation

Delta Electronics has released version v1.9.03.001 to address this vulnerability. Users should update their DIAEnergie installations to the latest version. No workarounds are mentioned in the advisory [1].