CVE-2021-32965
📋 TL;DR
Delta Electronics DIAScreen versions prior to 1.1.0 contain a type confusion vulnerability that could allow remote attackers to execute arbitrary code on affected systems. This affects industrial control systems using vulnerable DIAScreen software for HMI/SCADA applications. Attackers could potentially gain control of industrial processes.
💻 Affected Systems
- Delta Electronics DIAScreen
📦 What is this software?
Diascreen by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical process manipulation, production disruption, safety system bypass, or environmental damage.
Likely Case
Remote code execution allowing attackers to install malware, exfiltrate sensitive industrial data, or disrupt HMI/SCADA operations.
If Mitigated
Limited impact if systems are air-gapped, properly segmented, and have strict access controls preventing external communication.
🎯 Exploit Status
Type confusion vulnerabilities typically require specific knowledge of the software's memory layout and object structures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-05
Restart Required: Yes
Instructions:
1. Download DIAScreen version 1.1.0 from Delta Electronics
2. Backup current configuration and data
3. Install the updated version following vendor instructions
4. Restart the system
5. Verify successful installation
🔧 Temporary Workarounds
Network Segmentation
allIsolate DIAScreen systems from untrusted networks and internet access
Firewall Restrictions
allImplement strict firewall rules to limit inbound connections to DIAScreen systems
🧯 If You Can't Patch
- Implement strict network segmentation and air-gap vulnerable systems from untrusted networks
- Deploy application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check DIAScreen version in application interface or installation directory propertiesCheck Version:
Check application version through DIAScreen interface or Windows Program and FeaturesVerify Fix Applied:
Verify DIAScreen version shows 1.1.0 or higher in application properties📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from DIAScreen executable
- Network connections from DIAScreen to unexpected destinations
- Application crashes or unexpected behavior in DIAScreen
Network Indicators:
- Unexpected network traffic to/from DIAScreen systems
- Suspicious protocol usage targeting DIAScreen ports
SIEM Query:
Process creation where parent process contains 'DIAScreen' AND (process name contains 'cmd.exe' OR 'powershell.exe' OR 'wscript.exe')