CISA Warns of Delta Electronics Vulnerabilities Let Attackers Bypass Authentication

CISA issued a warning of two critical path traversal flaws in Delta Electronics’ DIALink industrial control system software. 

With a maximum CVSS v4 base score of 10.0, these vulnerabilities could be exploited remotely with low attack complexity to bypass authentication and gain unauthorized access to critical manufacturing environments.

Delta Electronics Path Traversal Flaws

Delta Electronics DIALink versions V1.6.0.0 and prior contain an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability, tracked as CVE-2025-58320. 

This flaw allows an attacker to craft specially encoded API or HTTP requests to traverse outside the intended application directory and access sensitive files.

With a CVSS v3.1 Base Score: 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and CVSS v4 Base Score: 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), the successful exploitation permits an unauthenticated adversary to read or modify configuration files such as credential stores or control logic scripts without triggering login prompts. 

Although code execution is not directly achievable via this CVE alone, unauthorized access to sensitive files can facilitate subsequent attacks or data exfiltration. 

CVE-2025-58321 is a more severe Path Traversal issue in the same DIALink product versions. Unlike CVE-2025-58320, this flaw enables both read and write access to arbitrary filesystem locations.

The vulnerability carries a CVSS v3.1 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4 Base Score: 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

An attacker can bypass authentication entirely, upload malicious files or scripts, and potentially execute code with the privileges of the DIALink service. 

This full control over file creation, deletion, and execution dramatically elevates the risk of disruption, ransomware deployment, or persistent backdoors in industrial environments. 

These vulnerabilities were privately reported by an anonymous researcher collaborating with Trend Micro’s Zero Day Initiative.

Mitigation

Both CVEs are remotely exploitable with low attack complexity, posing severe risks to critical manufacturing operations worldwide. 

Delta Electronics urges immediate upgrade to DIALink v1.8.0.0 or later, available via the Delta Download Center. Organizations should also:

• Segment OT networks behind firewalls and avoid direct Internet exposure of control systems.
• Use VPNs or secure gateways for all remote connections.
• Enforce strict separation between business and operational technology networks.
• Audit file system permissions and restrict directory access controls.

CISA recommends thorough impact analysis and risk assessments prior to patch deployment and encourages reporting of any suspicious activity to support collective threat intelligence.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.