CVE-2024-4547

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published May 6, 2024
CWE ID 20

Summary

CVE-2024-4547 is a SQL injection vulnerability affecting Delta Electronics DIAEnergie v1.10.1.8610 and earlier versions. The issue lies in the CEBC.exe component, which processes a 'RecalculateScript' message containing four fields separated by the '~' character. An unauthenticated remote attacker can exploit this vulnerability by manipulating the fourth field to inject malicious SQL statements, potentially gaining unauthorized access to sensitive data or executing arbitrary code.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share