CVE-2023-0822
Published: 17 February 2023
Summary
CVE-2023-0822 is a high-severity Improper Authorization (CWE-285) vulnerability in Deltaww Diaenergie. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 44.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12825
Vulnerability details
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorization checks via training and content reviews ensure only approved information is released to public systems.
Documenting access to processing and storage locations helps ensure correct authorization for information resources.
Requiring explicit approval for maintenance activities and component removal enforces proper authorization for critical system operations.
Procedures enforce authorization rules for media handling, making unauthorized actions harder to perform without detection.
Limiting media access to authorized parties addresses improper authorization for resource access.
The control requires authorization mechanisms and senior approval to prevent unauthorized viewing or alteration of the plan.
Mandates authorization checks so public access cannot perform disallowed operations or modifications.
Decoys identify and block exploitation of improper authorization by providing monitored targets that mimic protected functions.