CVE-2026-78317: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in deltaww DIAEnergie

This vulnerability in Delta DIAEnergie v1.11.00.002 is caused by improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. Exploitation can lead to remote code execution, compromising confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system, making it a critical risk for affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected system and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable version to untrusted networks.