CVE-2026-0975: Delta Electronics DIAView has Command Injection vulnerability.

PriorityP269critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.36%

68.2th percentile

Delta Electronics DIAView has Command Injection vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
delta_electronics	diaview	<= 4.2.0	—
deltaww	diaview	< 4.4.0	4.4.0

Detection & IOCsextracted from sources · hover to see the quote

→Exploitation requires a victim to open a malicious DIAView project file; monitor for unexpected process/shell execution spawned from DIAView application processes ↗
→DIAView project scripts can invoke shell commands; audit project script contents for unexpected shell command calls in DIAView v4.2.0 environments ↗
→Vulnerability is local/user-interaction required (AV:L/UI:R); focus detection on suspicious DIAView project files delivered via email attachments or untrusted downloads ↗

·Only DIAView version 4.2.0 is confirmed affected; version 4.4 and later are remediated ↗
·Vulnerability is not remotely exploitable; attack vector is local with required user interaction, limiting exposure to scenarios where a victim manually opens a malicious project ↗
·No known public exploitation has been reported at time of advisory publication ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.