Delta Electronics DIAScreen buffer overflow in project files
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four out-of-bounds write flaws in Delta DIAScreen affect version 1.6.0 and prior; requires user interaction to exploit via malicious project files.
CISA published an advisory on Delta Electronics DIAScreen, a visualization and monitoring software used in energy-critical infrastructure, documenting four distinct out-of-bounds write vulnerabilities (CWE-787). All four flaws share the same attack mechanism: when a valid user opens a maliciously crafted project file, the application writes data outside its allocated memory buffer. This can lead to information disclosure, integrity compromise, and availability impact. The vulnerabilities affect DIAScreen version 1.6.0 and earlier. CVSS v4 scores are 6.8 for each flaw, reflecting low attack complexity and the requirement for user interaction (opening a file). No remote exploitation is possible, and no active exploitation has been reported to CISA at the time of publication. Delta Electronics has released version 1.6.1 as a patch addressing all four vulnerabilities. The advisory recommends immediate patching on all affected systems and reinforces standard social engineering mitigations to prevent users from being tricked into opening malicious files.
Mentioned in this report
Detection guidance
DIAScreen Spawning Shell or Scripting Child Process
DIAScreen.exe spawning a command shell, script host or LOLBin, which may indicate exploitation of an out-of-bounds write via a crafted project file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DIAScreen Spawning Shell or Scripting Child Process
description: Detects Delta Electronics DIAScreen spawning command interpreters or
common living-off-the-land binaries. The visualization software does not normally
launch these, so a child process after a user opens a project file may indicate
memory-corruption exploitation (CWE-787) of a crafted file.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \DIAScreen.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Engineers using DIAScreen features or scripts that deliberately invoke cmd.exe for
automation
- Vendor installer or updater helper processes launched from the application
level: high
id: 71448887-1ebd-55e1-baa6-238f46cc1a2c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01
DIAScreen Launched by Email Client, Browser or Archiver
DIAScreen started directly from an email client, browser or archive utility, consistent with a user opening a phished project file attachment or download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DIAScreen Launched by Email Client, Browser or Archiver
description: Detects DIAScreen.exe started by an email client, web browser or archive
utility. This parent/child relation suggests a user opened a project file received
as an attachment or download, the delivery path for crafted DIAScreen project files.
Context needed, since engineers may legitimately open project files this way.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \DIAScreen.exe
ParentImage|endswith:
- \OUTLOOK.EXE
- \thunderbird.exe
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \WinRAR.exe
- \7zFM.exe
condition: selection
falsepositives:
- Engineers opening vendor-supplied project files directly from email or a browser
download
- Integrators receiving legitimate project files from OEM partners
level: medium
id: a9ed9f7b-d51d-5b80-a963-6ed2922d90b6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs