CVE-2021-38406
📋 TL;DR
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) has a memory corruption vulnerability when parsing project files, allowing attackers to execute arbitrary code with the privileges of the current user. This affects industrial control system operators using Delta's HMI configuration software. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Delta Electronic DOPSoft 2
📦 What is this software?
Dopsoft by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, manipulation of industrial processes, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or code execution when malicious project files are opened by users.
If Mitigated
Limited impact with proper network segmentation and user privilege restrictions.
🎯 Exploit Status
Exploitation requires user to open specially crafted project file; no authentication bypass needed once file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.00.08 or later
Vendor Advisory: https://www.deltaww.com/en-US/Support/Downloads/Detail?code=DOPSoft
Restart Required: Yes
Instructions:
1. Download DOPSoft 2 version 2.00.08 or later from Delta website. 2. Uninstall previous version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict project file handling
windowsConfigure application to only open project files from trusted sources; implement file integrity checking.
User privilege reduction
windowsRun DOPSoft with limited user privileges to reduce impact of successful exploitation.
🧯 If You Can't Patch
- Isolate DOPSoft systems on separate network segments with strict firewall rules
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check DOPSoft version via Help > About menu; versions 2.00.07 and earlier are vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 2.00.08 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of DOPSoft.exe
- Unusual file access patterns to .dop project files
Network Indicators:
- Unusual network connections from DOPSoft process
SIEM Query:
Process: DOPSoft.exe AND (EventID: 1000 OR EventID: 1001) OR FileAccess: *.dop from untrusted sources