DeltaWW vulnerabilities
We track 32 vulnerabilities in DeltaWW products across 20 products. 32 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 10, 2026.
Latest DeltaWW vulnerabilities
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection. This issue affects DIAEnergie: before 1.11.01.032.
- 9.3 Critical severity
DVP-12SE: Missing Authentication for Critical Functionality
Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions.
- 9.3 Critical severity
DVP-12SE: Allocation of Resources Without Limits or Throttling
Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service.
- 7.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code.
- 9.8 Critical severity
InfraSuite Device Master: Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
- 9.8 Critical severity
DTN Soft: Deserialization of Untrusted Data
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
- 7.5 High severity
DIAEnergie: Uncontrolled Resource Consumption
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQL
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform S
- 8.8 High severity
DIAEnergie: Improper Limitation of a Pathname to a Restricted Directory
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file wi
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- 9.8 Critical severity
DVW-W02W2-E2: Improper Neutralization of Special Elements used in a Command
The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by command injections and stack overflows vulnerabilities. Successful exploitation of these flaws would all
- 8.8 High severity
DIAEnergie: Client-Side Enforcement of Server-Side Security
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
- 7.8 High severity
CNCSoft-B v1.0.0.4 DOPSoft: Uncontrolled Search Path Element
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
- 7.5 High severity
DVP32ES2 PLC: Improper Resource Shutdown or Release
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclose
- 7.8 High severity
CNCSoft-B DOPSoft: Out-of-bounds Write
Delta Electronics' CNCSoft-B version 1.0.0.4 and DOPSoft versions 4.0.0.82 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
- 7.8 High severity
CNCSoft-B DOPSoft: Stack-based Buffer Overflow
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
- 7.8 High severity
CNCSoft-B DOPSoft: Out-of-bounds Write
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
- 9.0 Critical severity
DX-2100-L1-CN: Improper Neutralization of Input During Web Page Generation
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has creden
- 9.1 Critical severity
4G Router DX-3021: Improper Neutralization of Special Elements used in a Command
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.
- 7.5 High severity
Industrial Automation DIALink: Use of Hard-coded Credentials
Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data and compromise the machine.
- 9.8 Critical severity
Delta Electronics DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
- 9.8 Critical severity
Delta Electronics DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
- 9.8 Critical severity
DIAEnergy: Use of Hard-coded Credentials
Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 1.9.03.009 have this vulnerability. Executable files could be uploaded to certain directories using hard
- 8.6 High severity
Delta Robot Automation Studio (DRAS): Improper Restriction of XML External Entity Reference
Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere
- 7.8 High severity
Delta Electronics DOPSoft 2 Improper Input Validation Exploited
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code