CVE-2021-38406

Delta Electronics DOPSoft 2 Out-of-Bounds Write

Exploited in attacks High 7.8 Attack chance: 76%

What it is

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

CISA: Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.

What to do

The impacted product is end-of-life and should be disconnected if still in use.

Deadline for US federal agencies: September 15, 2022

Added to the CISA list: August 25, 2022
Published: September 17, 2021
Severity: High 7.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 76% in the top 0.5% of all known vulnerabilities
Weakness: CWE-787
More details: NVD · CVE.org · CISA

All references (1)

https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.