CVE-2022-4616

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-13 · updated 2026-06-17
Weakness: CWE-77

Description

The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.

Affected products

Delta Industrial Automation 4G Router DX-3021: before 1.24 — fixed in 1.24

How to fix

Upgrade to a fixed version: Delta Industrial Automation 4G Router DX-3021 1.24. Check the vendor advisory for mitigations.

References

https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060308&downloadID=DX&dataType=12&sort_expr=cdate&sort_dir=DESC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-05
https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060308&downloadID=DX&dataType=12&sort_expr=cdate&sort_dir=DESC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-05

Get alerted when CVE-2022-4616 or the next vulnerability affects your stack