At least 30 vulnerabilities were found in the past year in the DIAEnergie industrial energy management system made by Delta Electronics. The company says it has created patches for all of them, but for now most of those patches are only available on demand.
In August 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) informed organizations using the DIAEnergie product that researcher Michael Heinzl had identified eight vulnerabilities, including ones rated “critical severity.”
CISA has updated the advisory released in August and this week it published a new advisory describing more DIAEnergie vulnerabilities discovered by Heinzl, as well as Dusan Stevanovic from Trend Micro Security Research, who reported his findings through Trend Micro’s Zero Day Initiative (ZDI).
According to CISA’s advisories, a total of 30 security holes have been found in DIAEnergie. Some of them appear to have been patched in version 1.8 in September 2021. However, a majority of them have only been fixed more recently with version 1.08.02.004, which has not been made public, but is available on demand from Delta customer service. The public release of the version containing all patches is scheduled for June 30, 2022, CISA said.
Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference
Heinzl, who has published separate advisories for each of the flaws he has found, told SecurityWeek that exploitation does not require authentication and it could allow an attacker to take complete control of DIAEnergie and the systems it’s deployed on.
Of the 30 vulnerabilities found in DIAEnergie, 22 have been assigned a “critical severity” rating and five are “high severity.” A vast majority of the newly disclosed issues are SQL injection bugs affecting various components of the application.
After the first round of vulnerabilities were disclosed, Heinzl warned, “The consequences of a malicious actor’s actions could be dire for affected customers — falsifying monitoring data, suppressing alarms, using the system as the initial foothold in the network infrastructure for further pivoting, or simply ‘ransomwaring’ the deployment as has become so prevalent over the last five years or so.”
DIAEnergie is designed to help companies visualize and improve electric and power systems, particularly high-consumption equipment. The product is used around the world in various sectors. It can be integrated with various industrial control systems (ICS) and data sinks, including power meters, programmable logic controllers (PLCs) and other Modbus devices.
Related: High-Severity Vulnerabilities Patched in Omron PLC Programming Software
Related: Fuji Electric Patches Vulnerabilities in Factory Monitoring Software
Related: Several Critical Vulnerabilities Found in myPRO HMI/SCADA Product
