ICS Delta Industrial Automation DIAEnergie DIAE_dmdsetHandler.ashx order_by SQL Injection (CVE-2022-26013)

Rule ID

1231683

Severity

Critical

Description

An SQL injection has been reported in Delta Industrial Automation DIAEnergie. The vulnerability is due to lack of validation when processing order_by parameter in DIAE_dmdsetHandler.ashx endpoint.

Impact

SQL injection

Recommendation

Update vendor's patch.

IPS Category

ICS threats

IPS Anomaly Group

N/A

IPS Rule Default Action

Deny

References

Keywords

N/A