CVE-2026-0975
BaseFortify
Publication date: 2026-01-16
Last updated on: 2026-01-16
Assigner: Deltaww
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| delta_electronics | diaview | to 4.4 (exc) |
| delta_electronics | diaview | From 4.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0975 is a high-severity command injection vulnerability in Delta Electronics DIAView versions 4.2.0 and earlier. It allows an attacker to execute arbitrary commands remotely through an exposed dangerous method in the DIAView product. This can lead to remote code execution on the affected system. The vulnerability has been fixed in DIAView version 4.4 and later. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to remotely execute arbitrary commands on your DIAView system, potentially leading to full compromise of the affected device. This can result in unauthorized control, data loss, or disruption of services. Since there is no workaround, affected users should upgrade to DIAView version 4.4 or later to mitigate the risk. Additionally, exposure of control systems to the internet increases risk, so network isolation and secure remote access methods are recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade DIAView to version 4.4 or later, as the issue has been addressed in these versions. There is no workaround available. Additionally, general security recommendations include avoiding clicking on untrusted internet links or opening unsolicited email attachments, preventing exposure of control systems and equipment to the internet, placing systems behind firewalls and isolating them from business networks, and using secure remote access methods such as VPNs when remote access is necessary. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.