CVE-2023-43823
📋 TL;DR
A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft allows remote code execution when a user opens a malicious DPS file. This affects industrial automation systems using DOPSoft for HMI programming. Attackers can exploit this without authentication by tricking users into opening crafted files.
💻 Affected Systems
- Delta Electronics Delta Industrial Automation DOPSoft
📦 What is this software?
Dopsoft by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the workstation, potentially leading to lateral movement into industrial control systems.
Likely Case
Attacker executes arbitrary code on the engineering workstation, potentially stealing credentials, deploying ransomware, or manipulating HMI configurations.
If Mitigated
Limited impact if file execution is blocked or workstation is isolated, though denial of service may still occur.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file, but the buffer overflow itself is straightforward to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check vendor advisory
Vendor Advisory: https://www.deltaww.com/en-US/Service/Downloads/Detail?CID=070202&DID=0702020001
Restart Required: Yes
Instructions:
1. Check Delta Electronics website for security advisory
2. Download latest DOPSoft version
3. Install update
4. Restart system
🔧 Temporary Workarounds
Block DPS file execution
windowsPrevent execution of DPS files via application whitelisting or file extension blocking
Using AppLocker: New-AppLockerPolicy -RuleType Path -Action Deny -Path "*.dps"
Using Group Policy: Configure Software Restriction Policies
User awareness training
allTrain users not to open DPS files from untrusted sources
🧯 If You Can't Patch
- Isolate DOPSoft workstations from production networks
- Implement strict email filtering to block DPS attachments
🔍 How to Verify
Check if Vulnerable:
Check DOPSoft version against vendor advisory. If using unpatched version and DPS files are processed, system is vulnerable.Check Version:
In DOPSoft: Help → About DOPSoftVerify Fix Applied:
Verify DOPSoft version matches or exceeds patched version specified in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes of DOPSoft.exe
- Unusual process creation from DOPSoft
- Multiple failed file parsing attempts
Network Indicators:
- DPS file downloads from untrusted sources
- Outbound connections from DOPSoft to suspicious IPs
SIEM Query:
source="windows" AND (process_name="DOPSoft.exe" AND (event_id=1000 OR event_id=1001)) OR (file_name="*.dps" AND action="download")🔗 References
- https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wttitlelen-buffer-overflow-remote-code-execution/
- https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wttitlelen-buffer-overflow-remote-code-execution/
