CVE-2024-28171

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Delta Electronics	DIAEnergie	< v1.10.00.005
delta_electronics	diaenergie	< v1.10.00.005

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12Third Party Advisory, US Government Resource

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-281727.3Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to po CVE-2024-281734.3In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed CVE-2024-281745.8In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly CVE-2024-281755.4Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in CVE-2024-281765.9jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSO CVE-2024-281799.8Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated we CVE-2024-28186.5An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versio CVE-2024-281804.3Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JW CVE-2024-281818.1turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has exist CVE-2024-281825.3nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading th CVE-2024-281835.7ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulne CVE-2024-281847.4WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbit