Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-38420
• https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02