CVE-2024-4547

The CEBC.exe process handles 'RecalculateScript' type messages, which are split into 4 fields using '~' as a separator. The fourth field passed in this message is not properly validated or sanitized, which classifies the vulnerability as CWE-20 (Improper Input Validation) and CWE-89 (SQL Injection). An unauthenticated remote attacker can craft an appropriate message containing a malicious SQL payload and send it to the vulnerable process, gaining the ability to manipulate the database.

An attacker can gain unauthorized access to the database, read, modify or delete stored data, and potentially take control of the energy management system, which in industrial environments may lead to serious operational disruptions.

Patches available from the manufacturer should be applied according to the references. It is recommended to update to a version higher than v1.10.1.8610. Additionally, until the patch is deployed, it is recommended to restrict network access to the DIAEnergie system through a firewall and isolate the system in the OT/ICS network in accordance with the principle of least privilege.

Delta Electronics DIAEnergie version v1.10.1.8610 and all earlier versions.