CVE-2021-38424

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
Delta Electronics	DIALink	>= All, <= 1.2.4.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02Third Party Advisory, US Government Resource

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384259.1eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood CVE-2021-384267.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384277.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow CVE-2021-384284.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi CVE-2021-384299.1OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted CVE-2021-38436.7A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated CVE-2021-384307.8FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result CVE-2021-384314.3An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths CVE-2021-384329.8FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-b CVE-2021-384337.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a lo CVE-2021-384347.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384359.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, whic