CVE-2024-43699
📋 TL;DR
Delta Electronics DIAEnergie has an SQL injection vulnerability in the AM_RegReport.aspx script that allows unauthenticated attackers to extract database records. This affects industrial control systems using vulnerable versions of DIAEnergie software. Organizations using this energy management software for critical infrastructure are at risk.
💻 Affected Systems
- Delta Electronics DIAEnergie
📦 What is this software?
Diaenergie by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the DIAEnergie database including sensitive operational data, credentials, and potential lateral movement to connected industrial control systems.
Likely Case
Unauthorized access to energy management data, configuration details, and potentially credential harvesting from the database.
If Mitigated
Limited to attempted exploitation attempts that are blocked by network controls and monitoring.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and this requires no authentication, making it attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.1.0
Vendor Advisory: https://www.deltaww.com/en-US/Cybersecurity_Advisory
Restart Required: Yes
Instructions:
1. Download DIAEnergie version 1.10.1.0 from Delta Electronics portal. 2. Backup current installation and database. 3. Run the installer to upgrade. 4. Restart the DIAEnergie service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DIAEnergie systems from untrusted networks and internet access
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement strict network access controls to limit access to DIAEnergie web interface
- Deploy intrusion detection systems monitoring for SQL injection patterns against AM_RegReport.aspx
🔍 How to Verify
Check if Vulnerable:
Check DIAEnergie version in web interface or installation directory. Versions below 1.10.1.0 are vulnerable.Check Version:
Check web interface or installation properties for version numberVerify Fix Applied:
Verify version shows 1.10.1.0 or higher in DIAEnergie interface and test that AM_RegReport.aspx endpoint properly validates input.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed SQL syntax attempts
- Access to AM_RegReport.aspx with suspicious parameters
Network Indicators:
- HTTP requests to AM_RegReport.aspx containing SQL keywords
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*AM_RegReport.aspx*" AND (query="*SELECT*" OR query="*UNION*" OR query="*INSERT*" OR query="*DELETE*")