Delta Electronics DIAView is affected by a command injection flaw that permits an attacker to execute arbitrary system commands. The vulnerability falls under CWE-77 and can compromise the confidentiality, integrity, and availability of the system, allowing for full control of the affected service.

The vulnerability impacts all Delta Electronics DIAView deployments that use versions preceding v4.4; versions 4.4 or later include the necessary patch. No specific sub‑versions are listed, so any instance of DIAView prior to the upgrade is potentially exploitable.

The CVSS score of 7.8 marks this flaw as high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is remote, requiring the attacker to transmit malicious input to the exposed dangerous method; authentication requirements are not specified but are presumed unnecessary as the flaw is exposed via a public endpoint.