CVE-2024-4548: Deltaww Diaenergie

Critical severity, CVSS 9.8. EPSS: 29.4% chance of exploitation in the next 30 days.

An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.

Affected products

• Deltaww Diaenergie: before 1.10.01.004 (fixed in 1.10.01.004)

Published 2024-05-06. Last modified 2026-06-17.