CVE-2021-38411

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Delta Electronics	DIALink	>= All, <= 1.2.4.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02Third Party Advisory, US Government Resource

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384129.8Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not req CVE-2021-384137.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow a CVE-2021-384157.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a special CVE-2021-384167.8Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeov CVE-2021-384177.5VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user v CVE-2021-384185.9Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traff CVE-2021-384197.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data CVE-2021-38427.5nltk is vulnerable to Inefficient Regular Expression Complexity CVE-2021-384207.8Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which m CVE-2021-384217.1Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attack CVE-2021-384227.8Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensiv CVE-2021-384239.8All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.