{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0975", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "state": "PUBLISHED", "assignerShortName": "Deltaww", "dateReserved": "2026-01-15T02:06:19.402Z", "datePublished": "2026-01-16T06:01:59.903Z", "dateUpdated": "2026-01-16T14:00:54.208Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "DIAView", "vendor": "Delta Electronics", "versions": [{"lessThanOrEqual": "4.2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "coordinator", "value": "CISA"}, {"lang": "en", "type": "reporter", "value": "ZDI"}], "datePublic": "2026-01-15T02:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Delta Electronics DIAView has Command Injection vulnerability."}], "value": "Delta Electronics DIAView has Command Injection vulnerability."}], "impacts": [{"capecId": "CAPEC-19", "descriptions": [{"lang": "en", "value": "CAPEC-19 Embedding Scripts within Scripts"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-01-16T06:01:59.903Z"}, "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00002_DIAView%20-Exposed%20Dangerous%20Method%20Remote%20Code%20Execution%20(CVE-2026-0975).pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Please download and upgrade DIAView to v4.4 or later."}], "value": "Please download and upgrade DIAView to v4.4 or later."}], "source": {"discovery": "EXTERNAL"}, "title": "DIAView - Command Injection Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:00:42.754921Z", "id": "CVE-2026-0975", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:00:54.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T14:00:42.754921Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:00:50.590Z"}}], "cna": {"title": "DIAView - Command Injection Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "coordinator", "value": "CISA"}, {"lang": "en", "type": "reporter", "value": "ZDI"}], "impacts": [{"capecId": "CAPEC-19", "descriptions": [{"lang": "en", "value": "CAPEC-19 Embedding Scripts within Scripts"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Delta Electronics", "product": "DIAView", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.2.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please download and upgrade DIAView to v4.4 or later.", "supportingMedia": [{"type": "text/html", "value": "Please download and upgrade DIAView to v4.4 or later.", "base64": false}]}], "datePublic": "2026-01-15T02:22:00.000Z", "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00002_DIAView%20-Exposed%20Dangerous%20Method%20Remote%20Code%20Execution%20(CVE-2026-0975).pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Delta Electronics DIAView has Command Injection vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Delta Electronics DIAView has Command Injection vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-01-16T06:01:59.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0975", "state": "PUBLISHED", "dateUpdated": "2026-01-16T14:00:54.208Z", "dateReserved": "2026-01-15T02:06:19.402Z", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "datePublished": "2026-01-16T06:01:59.903Z", "assignerShortName": "Deltaww"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:diaview:*:*:*:*:*:*:*:*", "matchCriteriaId": "F27FF503-4356-4F27-9A1A-15F4680501BB", "versionEndExcluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Delta Electronics DIAView has Command Injection vulnerability."}], "id": "CVE-2026-0975", "lastModified": "2026-01-20T19:20:21.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-16T06:15:51.187", "references": [{"source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "tags": ["Vendor Advisory"], "url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00002_DIAView%20-Exposed%20Dangerous%20Method%20Remote%20Code%20Execution%20(CVE-2026-0975).pdf"}], "sourceIdentifier": "759f5e80-c8e1-4224-bead-956d7b33c98b", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:49:20.728890+00:00", "value": {"mitigation_remediation": ["Apply Delta Electronics DIAView version 4.4 or later, which removes the vulnerable method.", "If the configuration allows, disable or remove the exposed dangerous method so it cannot be reached by external parties.", "Configure logging and monitoring to detect and alert on attempts to invoke the removed or disabled method."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Command Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts all Delta Electronics DIAView deployments that use versions preceding v4.4; versions 4.4 or later include the necessary patch. No specific sub\u2011versions are listed, so any instance of DIAView prior to the upgrade is potentially exploitable.", "description_and_impact": "Delta Electronics DIAView is affected by a command injection flaw that permits an attacker to execute arbitrary system commands. The vulnerability falls under CWE-77 and can compromise the confidentiality, integrity, and availability of the system, allowing for full control of the affected service.", "risk_and_exploitability": "The CVSS score of 7.8 marks this flaw as high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is remote, requiring the attacker to transmit malicious input to the exposed dangerous method; authentication requirements are not specified but are presumed unnecessary as the flaw is exposed via a public endpoint."}}}}, "created": "2026-01-16T13:41:32.688048+00:00", "updated": "2026-04-18T06:00:08.485432+00:00", "vendors": ["delta_electronics", "delta_electronics$PRODUCT$diaview"]}