CVE-2024-4549: Deltaww DIAEnergie DOS Vulnerability

CVE-2024-4549 Overview

CVE-2024-4549 is a denial of service vulnerability in Delta Electronics DIAEnergie, an industrial energy management system used in manufacturing and critical infrastructure environments. The flaw resides in the CEBC.exe component, which restarts the host system when it processes an ICS Restart! message. An unauthenticated remote attacker on the network can trigger a full system restart by sending the crafted message, disrupting availability of the energy monitoring platform. The vulnerability affects DIAEnergie versions v1.10.1.8610 and prior and is categorized under [CWE-400] uncontrolled resource consumption.

Critical Impact
An unauthenticated network attacker can force the DIAEnergie host to restart, interrupting industrial energy monitoring and reporting workflows.

Affected Products

Delta Electronics DIAEnergie v1.10.1.8610
Delta Electronics DIAEnergie prior versions
CEBC.exe service component within DIAEnergie

Discovery Timeline

2024-05-06 - CVE-2024-4549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4549

Vulnerability Analysis

DIAEnergie ships with CEBC.exe, a service component that processes control messages over the network. When the service receives a message containing the ICS Restart! directive, it executes a full system restart routine instead of validating the source, authorization, or operational context of the request. The behavior was documented by Tenable Security Research, which catalogued the issue under research advisory TRA-2024-13. The result is an availability-only impact: confidentiality and integrity are unaffected, but the host running DIAEnergie reboots whenever the message is delivered. In industrial environments, repeated restarts disrupt energy data collection, reporting dashboards, and downstream analytics that depend on continuous telemetry.

Root Cause

The root cause is uncontrolled execution of a privileged action triggered by an untrusted input. CEBC.exe treats the ICS Restart! message as a trusted command without enforcing authentication, authorization, or rate limiting. This maps to [CWE-400] uncontrolled resource consumption because attackers can repeatedly drive the host into a restart loop, exhausting system availability.

Attack Vector

Exploitation requires network reachability to the DIAEnergie host and no privileges or user interaction. An attacker sends the ICS Restart! message to the listening CEBC.exe service, and the operating system reboots. Repeating the request maintains a denial of service condition. Refer to the Tenable Security Research Analysis for the technical breakdown of the message handling logic.

No public proof-of-concept exploit code has been released, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 1.109% at the 61.8 percentile, indicating moderate predicted exploitation likelihood relative to the broader CVE population.

Detection Methods for CVE-2024-4549

Indicators of Compromise

Unexpected system restarts on hosts running DIAEnergie CEBC.exe
Inbound network traffic to the DIAEnergie service containing the string ICS Restart!
Windows event log entries showing unplanned shutdowns correlated with external network connections
Gaps in DIAEnergie telemetry, energy reports, or dashboard data tied to host reboot windows

Detection Strategies

Inspect network traffic destined for DIAEnergie hosts for the ICS Restart! payload using IDS/IPS signatures.
Correlate Windows EventID 1074 and EventID 6008 shutdown events with preceding network sessions to the CEBC.exe process.
Baseline normal restart frequency for DIAEnergie servers and alert on deviations.
Monitor for repeated connection attempts from the same source against the DIAEnergie service port.

Monitoring Recommendations

Forward DIAEnergie host event logs and network flow data to a centralized analytics platform for correlation.
Track CEBC.exe process lifecycle events, including unexpected terminations and service restarts.
Alert on any system reboot of an OT or industrial host outside of approved maintenance windows.
Audit firewall logs for unauthorized external sources reaching DIAEnergie management interfaces.

How to Mitigate CVE-2024-4549

Immediate Actions Required

Restrict network access to DIAEnergie hosts so that only authorized engineering workstations can reach CEBC.exe.
Place DIAEnergie servers inside a segmented OT network zone behind a firewall that blocks untrusted inbound traffic.
Review Windows event logs for prior unexplained restarts that match the indicators above.
Contact Delta Electronics support to confirm the latest fixed release for DIAEnergie.

Patch Information

No vendor advisory URL is referenced in the published CVE record. Administrators should consult Delta Electronics directly for an updated DIAEnergie build that supersedes v1.10.1.8610. Technical details are available in the Tenable Security Research Analysis.

Workarounds

Block external access to the DIAEnergie service port at the network perimeter and internal firewalls.
Apply an allowlist on host-based firewalls so that only trusted management IPs can reach CEBC.exe.
Disable or stop CEBC.exe on systems where the restart messaging functionality is not required for operations.
Monitor for the ICS Restart! string with network detection rules until a vendor patch is deployed.

bash

# Configuration example: Windows firewall rule restricting access to DIAEnergie
netsh advfirewall firewall add rule name="DIAEnergie-Restrict-CEBC" ^
  dir=in ^
  action=block ^
  program="C:\Program Files\Delta Industrial Automation\DIAEnergie\CEBC.exe" ^
  remoteip=any

# Allow only trusted management subnet
netsh advfirewall firewall add rule name="DIAEnergie-Allow-Mgmt" ^
  dir=in ^
  action=allow ^
  program="C:\Program Files\Delta Industrial Automation\DIAEnergie\CEBC.exe" ^
  remoteip=10.10.20.0/24