Delta Electronics DIAScreen
Monitor6.6ICS-CERT ICSA-25-280-01Oct 7, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
A buffer overflow vulnerability (CWE-787) in Delta Electronics DIAScreen versions 1.6.0 and earlier allows an attacker with local access to write data outside allocated memory buffers, potentially causing memory corruption, application crashes, or unexpected behavior. The vulnerability requires user interaction to trigger and is not remotely exploitable. Delta Electronics has released version 1.6.1 with a fix.
What this means
What could happen
An attacker with local access to a system running DIAScreen could write data outside allocated memory buffers, potentially causing application crashes or unexpected behavior that could disrupt control screen operations.
Who's at risk
This affects operators and engineers who use Delta Electronics DIAScreen visualization software for monitoring and controlling industrial processes. DIAScreen is typically deployed on control workstations or operator stations in water treatment, power distribution, and manufacturing facilities.
How it could be exploited
An attacker must have local access to a computer running DIAScreen and would need to interact with the application in a way that triggers the buffer write vulnerability—likely through a specially crafted input or file that the application processes. This is not remotely exploitable.
Prerequisites
- Local access to the system running DIAScreen
- Ability to interact with or send input to the DIAScreen application
- User interaction (e.g., opening a file or clicking a link) may be required to trigger the vulnerability
local access requireduser interaction requiredno remote exploitationlow complexity attackaffects availability and integrity
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (1)
ProductAffected VersionsFix Status
DIAScreen: <=1.6.0≤ 1.6.01.6.1
Remediation & Mitigation
0/3
Do now
0/1HARDENINGEducate operators not to open untrusted files or click links from unsolicited messages that could trigger exploitation
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate DIAScreen to version 1.6.1 or later
Long-term hardening
0/1HARDENINGRestrict local access to systems running DIAScreen to authorized personnel only; implement physical access controls and user access management
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2cdeb065-8bc8-4c7d-90ba-741505c0828c