High severity · published Mar 25, 2022
CVE-2022-0988
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Diaenergie · Deltaww
through 1.7.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0988
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
More from Diaenergie
9.8
CVE-2026-78308
Authentication Bypass in DIAEnergie
9.8
CVE-2024-43699
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx
9.8
CVE-2024-4548
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the…
9.8
CVE-2024-4547
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the…
9.8
CVE-2024-25574
SQL injection vulnerability exists in GetDIAE_usListParameters