Hard-Coded Cryptographic Key Vulnerability in Delta Industrial Automation DIALink
CVE-2022-2660

9.8CRITICAL

Key Information:

Vendor
Delta Electronics
Status
Industrial Automation Dialink
Vendor
CVE Published:
13 December 2022

Summary

Delta Industrial Automation's DIALink software, specifically versions 1.4.0.0 and earlier, contains a security flaw involving a hard-coded cryptographic key. This vulnerability enables attackers to decrypt sensitive data, posing risks to the integrity and confidentiality of critical machine operations. Organizations using affected versions must implement immediate remediation to safeguard against potential data breaches.

Affected Version(s)

Industrial Automation DIALink 0

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-02

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Y4er working with Trend Micro Zero Day Initiative reported this vulnerability to CISA
.