CVE-2021-38406highunder attackCWE-787

CVE-2021-38406: high-severity vulnerability in Delta Electronics DOPSoft 2

Delta Electronics DOPSoft 2 Out-of-Bounds Write

Published · Updated

Follow this CVE+ Monitor DOPSoft

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 76%
from disclosure to weapon
Published on NVDSep 17
CISA KEV+342d
Action required by CISAfederal deadline: 2022-09-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

Delta Electronics DOPSoft 2 software has a flaw where it doesn't properly check data in project files, allowing attackers to write data outside intended memory areas and run malicious code on the affected computer.

Technical detail

The vulnerability is an out-of-bounds write (CWE-787) triggered by insufficient input validation when parsing project files in DOPSoft 2 versions 2.00.07 and prior. An attacker with the ability to provide a crafted project file can overwrite adjacent memory regions, achieving arbitrary code execution in the application's context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Delta Electronics · DOPSoft 2
Related CVEs — Delta Electronics DOPSoft 2

In the same product, most dangerous first.

CVE-2021-38402HIGHDelta Electronics DOPSoft 2 Stack-Based Buffer OverflowEPSS 7.1%CVE-2021-38404HIGHDelta Electronics DOPSoft 2 Heap-based Buffer OverflowEPSS 1.0%