Executive brief
Delta Electronics DIAView, a software package used for industrial monitoring and data visualization, contains a critical security flaw that allows unauthorized users to access its internal databases. This issue stems from an incomplete fix for a previous vulnerability, meaning existing security updates may not fully protect the system. An attacker could remotely view or modify sensitive industrial data, potentially disrupting operations or compromising proprietary information.
Technical details
This vulnerability is a mitigation bypass for CVE-2025-62582, resulting from an incomplete fix for unauthenticated remote database access. The root cause is identified as the use of hard-coded cryptographic keys (CWE-321) within the DIAView software. An unauthenticated attacker can exploit this over the network to gain full access to the project's configured databases. This allows for unauthorized data retrieval, modification, or deletion. As of the advisory date, no official patch is available, and the vendor has acknowledged the limitation of current fixes.
Affected products
- Delta Electronics DIAView V4.4
Timeline
- 2026-01-21: other: Tenable notifies Delta that the previous patch is insufficient
- 2026-05-26: disclosed: Initial advisory release
- 2026-05-26: advisory: NVD publication date