CVE-2021-38402
📋 TL;DR
Delta Electronic DOPSoft 2 software versions 2.00.07 and earlier contain a stack-based buffer overflow vulnerability when parsing project files. This allows attackers to execute arbitrary code with the privileges of the current user. Organizations using DOPSoft 2 for HMI/SCADA programming are affected.
💻 Affected Systems
- Delta Electronic DOPSoft 2
📦 What is this software?
Dopsoft by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, potentially allowing attackers to manipulate industrial processes, steal sensitive data, or pivot to other systems.
Likely Case
Local privilege escalation or code execution when users open malicious project files, potentially leading to industrial control system manipulation.
If Mitigated
Limited impact with proper network segmentation and user privilege restrictions, though local code execution remains possible.
🎯 Exploit Status
Requires user interaction to open malicious project file; no public exploit code known but vulnerability details are public.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.00.08 or later
Vendor Advisory: https://www.deltaww.com/en-US/Service/DownloadCenter
Restart Required: Yes
Instructions:
1. Download DOPSoft 2 version 2.00.08 or later from Delta website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict project file handling
windowsBlock or restrict opening of .dop project files from untrusted sources
Application whitelisting
windowsImplement application control to prevent execution of unauthorized code
🧯 If You Can't Patch
- Segment DOPSoft systems from critical networks using firewalls
- Implement strict user privilege management and disable unnecessary user accounts
🔍 How to Verify
Check if Vulnerable:
Check DOPSoft 2 version in Help > About; if version is 2.00.07 or earlier, system is vulnerable.Check Version:
Check Help > About in DOPSoft 2 applicationVerify Fix Applied:
Verify version is 2.00.08 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes of DOPSoft.exe
- Unusual process creation from DOPSoft process
Network Indicators:
- Unusual network connections from engineering workstations
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName='DOPSoft.exe'