CVE-2022-1098
Assigner: icscert
Published: 2022-03-29T00:00:00
State: PUBLISHED
affected: product: DIAEnergie
vendor: DIAEnerrgie
versions: lessThan: 1.8.02.004
status: affected
version: unspecified
versionType: custom
datePublic: 2022-03-29T00:00:00
descriptions: value: Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-427
description: CWE-427 Uncontrolled Search Path Element
type: CWE
solutions: value: Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.
source: advisory: ICSA-22-081-01
discovery: UNKNOWN
title: Delta Electronics DIAEnergie Uncontrolledly Search Path Element
x_generator: engine: Vulnogram 0.0.9