CVE-2021-32967

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-329687.5Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attackeCVE-2021-329697.8Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash oCVE-2021-32977.8On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.CVE-2021-329707.5Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which maCVE-2021-329717.5Null pointer dereference in SuiteLink server while processing command 0x07CVE-2021-329725.5Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser CVE-2021-329749.8Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote atCVE-2021-329757.8Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-CVE-2021-329769.8Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attackCVE-2021-329777.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.CVE-2021-329787.5The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered passwoCVE-2021-329797.5Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a