7.8High
KEV
CVE-2021-38406Delta Electronics DOPSoft 2 Out-of-Bounds Write
Known exploited — Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
CISA confirmed this vulnerability is used in real attacks on 25.08.2022. Remediation deadline for US federal agencies: 15.09.2022.
Required action: The impacted product is end-of-life and should be disconnected if still in use. https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-02; https://nvd.nist.gov/vuln/detail/CVE-2021-38406
Description
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
Weakness (CWE):
CWE-787
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Delta Electronics | DOPSoft 2 | unspecified – ≤ 2.00.07 | |
| deltaww | dopsoft | 2.00 – ≤ 2.00.07 |
References and patches
- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02 Third Party AdvisoryUS Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38406 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:deltaww:dopsoft:*:*:*:*:*:*:*:*≥ 2.00 ≤ 2.00.07