A critical vulnerability involving hard-coded cryptographic keys in Delta Electronics DIAView allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability.

This vulnerability (CWE-321) arises from the use of hard-coded cryptographic keys within the software. The attack vector is network-based and requires no authentication (AV:N/AC:L/PR:N/UI:N), making it highly accessible to remote actors.

The use of hard-coded keys effectively bypasses encryption mechanisms, potentially granting attackers access to sensitive process data or the ability to inject malicious commands into the control environment. Given the CVSS score of 9.8, this represents a total loss of confidentiality, integrity, and availability, posing a severe risk to operational continuity and industrial safety.

Immediate Action: Upgrade to DIAView v4.4 or later immediately as directed by the vendor.

Proactive Monitoring: Monitor network traffic for unusual patterns and review system access logs for unauthorized attempts to interact with the DIAView service.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level segmentation to restrict access to the DIAView interface until the software can be updated.

Public Exploit Available: Unknown

Due to the critical severity and the potential for complete system compromise, organizations running DIAView must prioritize this update. Ensure that all instances are identified and patched to version 4.4 or higher immediately to eliminate the risk posed by the hard-coded cryptographic keys.