Delta Electronics DIAView

An attacker who tricks a user into opening a malicious file or link could execute arbitrary code on the engineering workstation running DIAView, potentially compromising control system design, configuration, or monitoring capabilities.

Water authorities and utilities operating Delta Electronics DIAView for SCADA/HMI engineering, configuration, and monitoring should prioritize this update. Impact is limited to engineering workstations and design/engineering teams, but compromise of these systems could lead to unauthorized modifications of control logic or setpoints affecting treatment or distribution operations.

An attacker crafts a malicious file or email link that, when opened by a DIAView operator or engineer, triggers the command injection vulnerability. The attacker's code runs with the same privileges as the DIAView application on the workstation, allowing them to read/modify control system configurations or escalate further into the network.