{"id":"CVE-2026-125612","published":"2026-11-10T03:16:42.547","lastModified":"2026-11-10T20:19:09.657","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00017_DIAEnergie%20SQL%20Injection%20Vulnerability_v1.0.pdf","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection flaw exists in Deltaww DIAEnergie due to improper neutralization of user-supplied input in SQL commands, allowing attackers with low privileges to execute arbitrary SQL queries. This affects versions prior to 1.11.01.032 and could lead to full data compromise.","exploitability":"Exploitation requires low-privilege network access (authenticated or unauthenticated depending on endpoint exposure) and no user interaction; the vulnerability is straightforward to exploit using standard SQL injection techniques.","blast_radius":"Successful exploitation could enable full database exfiltration, modification, or deletion, potentially disrupting critical energy infrastructure operations dependent on DIAEnergie.","remediation":"Upgrade DIAEnergie to version 1.11.01.032 or later.","detection":"Defenders should monitor web server and application logs for SQL injection patterns such as single quotes, UNION SELECT, OR 1=1, or time-based delays in HTTP request parameters; look for异常 HTTP 500 responses or unusually long query execution times in database logs. No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","ics","high-severity","low-privilege","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:48:52.752Z"}}