PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-62582 Delta Electronics CVE debrief

Delta Electronics DIAView contains multiple critical vulnerabilities that permit unauthenticated remote attackers to achieve full system compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-exploitable, low-complexity attacks requiring no privileges or user interaction, resulting in complete confidentiality, integrity, and availability loss. The associated CWE-306 (Missing Authentication for Critical Function) suggests authentication bypass as a root cause. Affected versions span all releases prior to 4.4.0. Delta Electronics published security advisory PCSA-2026-00001 addressing CVE-2025-62581 and CVE-2025-62582. The CVE was initially published on 2026-01-16 and last modified on 2026-05-29, indicating recent updates to vulnerability details or affected product information. No known exploitation in ransomware campaigns has been documented (KEV: false).

Vendor
Delta Electronics
Product
DIAView
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-16
Original CVE updated
2026-05-29
Advisory published
2026-01-16
Advisory updated
2026-05-29

Who should care

OT security teams, industrial control system operators, SCADA/HMI administrators, manufacturing security personnel, and organizations utilizing Delta Electronics DIAView for process visualization and control

Technical summary

DIAView versions prior to 4.4.0 contain missing authentication vulnerabilities (CWE-306) enabling unauthenticated network-based attacks. The critical CVSS 9.8 score reflects complete system compromise potential without user interaction. Attack vectors are network-accessible with low exploitation complexity.

Defensive priority

CRITICAL

Recommended defensive actions

  • Upgrade DIAView to version 4.4.0 or later per vendor advisory
  • Review network segmentation for DIAView installations to restrict unauthorized access
  • Monitor for anomalous authentication attempts or unauthorized administrative actions
  • Apply principle of least privilege to DIAView service accounts
  • Verify backup and recovery procedures for affected SCADA/HMI systems

Evidence notes

NVD CPE confirms deltaww:diaview:*:*:*:*:*:*:*:* versions prior to 4.4.0 are vulnerable. CVSS 9.8 CRITICAL score derived from official NVD record. CWE-306 (Missing Authentication for Critical Function) identified as secondary weakness.

Official resources

Vendor-disclosed via Delta Electronics security advisory PCSA-2026-00001