CISA Warns of Critical Flaw in Delta DIALink: CVE-2025-58321 (CVSS 10.0)

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory warning of two serious vulnerabilities in Delta Electronics DIALink, a widely used industrial networking tool. The flaws, CVE-2025-58320 and CVE-2025-58321, arise from improper directory path handling and could allow attackers to bypass authentication and gain unauthorised access to critical systems, with CVSS v3.1 base scores of 7.3 and 10 respectively. The affected product versions include DIALink V1.6.0.0 and prior.

According to the advisory, successful exploitation of these vulnerabilities could allow an attacker to bypass authentication. CISA and Delta Electronics strongly recommend upgrading to DIALink v1.8.0.0 or later, available via the Delta Download Center. Delta has also issued cybersecurity best practices to reduce risk, including avoiding untrusted links, isolating control systems from the internet, and employing a VPN for remote access. These warnings emphasise the critical nature of the flaws, even though no public exploitation had been reported at the time of the advisory.