Medium severity · published Nov 3, 2021
CVE-2021-38428
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the…
4.8
CVSS
11.4%
EPSS
No
On KEV
Description
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)11.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Dialink · Deltaww
through 1.2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-38428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-38428
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
More from Dialink
10.0
CVE-2025-58321
DIALink - Directory Traversal Authentication Bypass Vulnerability
7.8
CVE-2021-38424
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data
7.8
CVE-2021-38422
Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory…
7.8
CVE-2021-38420
Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the…
7.8
CVE-2021-38416
Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is…