CVE-2021-32967CWE-288

Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which…

published August 30, 2021

CVSS
—
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

⚠️ A crafty hacker could add themselves as an admin on Delta Electronics DIAEnergie without breaking a sweat! 🚪💻 Think of it like a hotel that forgot to check IDs at check-in — anyone could waltz in and get a master key to every room, no questions asked. This small oversight can open the doors to a lot of trouble! An attacker could gain full administrative access, allowing them to manipulate settings, read sensitive data, or even disrupt operations entirely. It's like handing over the keys to your house to a complete stranger!

Put simply

Think of it like a hotel that forgot to check IDs at check-in — anyone could waltz in and get a master key to every room, no questions asked. This small oversight can open the doors to a lot of trouble! This vulnerability in Delta Electronics DIAEnergie versions 1.7.5 and prior allows unauthenticated users to create new administrative accounts, bypassing necessary authentication and authorization checks.

What to do

An attacker could gain full administrative access, allowing them to manipulate settings, read sensitive data, or even disrupt operations entirely. It's like handing over the keys to your house to a complete stranger! To secure your systems, immediately update to the latest version of DIAEnergie. Regularly review user accounts and permissions to ensure there are no unauthorized users lurking around. 🛡️ You've got this! With these steps, you’ll keep your system secure and your admin keys safe! 🔐✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01382 · 71.9th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2021-08-30T17:11Z
EPSS history
Timeline
  • 30 AUG 17:11Z
    Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which…
    cvelistv5