CVE-2022-25347: delta electronics diaenergie
CVSS: 9.8v3.1CriticalModified
Published 29-03-2022Last modified 16-04-2025
Vulnerability summary
CVE-2022-25347 is a critical (CVSS 9.8) vulnerability in delta electronics diaenergie. EPSS estimates a 11.39% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
11.39%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 29-03-2022PublishedVulnerability first disclosed.
- 16-04-2025Last modifiedVulnerability information updated.
Description
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources2 sources · 7.5–9.8
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
11.39%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.39% on 22-09-2026
22-09-202622-10-2026
EPSS score11.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-37Path Traversal: '/absolute/pathname/here'The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Delta electronics1 product
- diaenergie≥ unspecified, < 1.8.02.004
Deltaww1 product
- diaenergie< 1.8.02.004
2 vendors · 2 products
References
1 links
www.cisa.gov/uscert/ics/advisories/icsa-22-081-01X Refsource CONFIRMMitigationThird Party AdvisoryUS Government Resource