Details of VAR-202210-1863

ID

VAR-202210-1863

CVE

CVE-2022-40967

TITLE

Delta Electronics, INC. of DIAEnergie In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-019031

DESCRIPTION

The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. Delta Electronics, INC. of DIAEnergie for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency

Trust: 2.16

sources: NVD: CVE-2022-40967 // JVNDB: JVNDB-2022-019031 // CNNVD: CNNVD-202210-2391

AFFECTED PRODUCTS

vendor:	deltaww	model:	diaenergie	scope:	lt	version:	1.9.01.002	Trust: 1.0
vendor:	delta	model:	diaenergie	scope:	eq	version:	1.9.01.002	Trust: 0.8
vendor:	delta	model:	diaenergie	scope:	-	version:	-	Trust: 0.8
vendor:	delta	model:	diaenergie	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-019031 // NVD: CVE-2022-40967

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-40967
value:	HIGH
Trust: 1.8
ics-cert@hq.dhs.gov:	CVE-2022-40967
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202210-2391
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2022-40967
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-019031 // NVD: CVE-2022-40967 // NVD: CVE-2022-40967 // CNNVD: CNNVD-202210-2391

PROBLEMTYPE DATA

problemtype:	CWE-89	Trust: 1.0
problemtype:	SQL injection (CWE-89) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-019031 // NVD: CVE-2022-40967

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-2391

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202210-2391

CONFIGURATIONS

sources: NVD: CVE-2022-40967

EXTERNAL IDS

db:	NVD	id:	CVE-2022-40967	Trust: 3.2
db:	ICS CERT	id:	ICSA-22-298-06	Trust: 2.4
db:	JVN	id:	JVNVU91874962	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-019031	Trust: 0.8
db:	CNNVD	id:	CNNVD-202210-2391	Trust: 0.6

sources: JVNDB: JVNDB-2022-019031 // NVD: CVE-2022-40967 // CNNVD: CNNVD-202210-2391

REFERENCES

url:	https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06	Trust: 2.4
url:	https://jvn.jp/vu/jvnvu91874962/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-40967	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-40967/	Trust: 0.6

sources: JVNDB: JVNDB-2022-019031 // NVD: CVE-2022-40967 // CNNVD: CNNVD-202210-2391

SOURCES

db:	JVNDB	id:	JVNDB-2022-019031
db:	NVD	id:	CVE-2022-40967
db:	CNNVD	id:	CNNVD-202210-2391

LAST UPDATE DATE

2023-12-18T11:55:27.707000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-019031	date:	2023-10-24T05:51:00
db:	NVD	id:	CVE-2022-40967	date:	2022-10-28T18:35:49.140
db:	CNNVD	id:	CNNVD-202210-2391	date:	2022-10-31T00:00:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-019031	date:	2023-10-24T00:00:00
db:	NVD	id:	CVE-2022-40967	date:	2022-10-27T21:15:14.650
db:	CNNVD	id:	CNNVD-202210-2391	date:	2022-10-27T00:00:00