The vulnerability is a classic SQL Injection flaw in DIAEnergie that allows an attacker to inject arbitrary SQL statements into database queries. This weakness can lead to unauthorized data exposure, data modification, or potentially remote code execution if the database user has elevated privileges. The flaw is identified as CWE‑89.

The affected system is Deltaww’s DIAEnergie application. Clients running any version prior to 1.11.00.022 are vulnerable; versions 1.11.00.022 and newer are not impacted according to the vendor advisory.

The CVSS score of 8.8 classifies this vulnerability as high severity. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the flaw is listed as not in the CISA KEV catalog. The likely attack vector is through web interfaces or input mechanisms that are not properly sanitized, as inferred from the SQL Injection description. Exploitation would require the attacker to supply crafted input that the application forwards to the database engine.