CVE-2021-38406
Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
Description
CVE-2021-38406 is an improper input validation vulnerability in Delta Electronics DOPSoft 2, a Human-Machine Interface (HMI) configuration software used in industrial control systems (ICS). The software lacks proper validation of user-supplied data when parsing specific project files, resulting in an out-of-bounds write that enables arbitrary code execution. This vulnerability is particularly concerning because it targets industrial automation software, where exploitation could impact physical processes and operational technology environments. CISA has added CVE-2021-38406 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 70.4% (99th percentile), exploitation probability is very high. The product is end-of-life and will not receive patches.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| deltaww | dopsoft | >= 2.00, <= 2.00.07 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38406(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2021-38406 exploits an out-of-bounds write weakness in Delta Electronics DOPSoft 2, where parsing of specially crafted project files causes the application to write data beyond the boundaries of an allocated buffer. The lack of proper input validation on user-supplied data in project files allows an attacker to control the content and location of the write operation, overwriting critical memory structures and redirecting program execution to attacker-supplied code.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-38406 poses a significant risk to industrial control system environments. The vulnerability requires local access or user interaction — specifically, the victim must open a maliciously crafted DOPSoft 2 project file. Once the file is opened, the out-of-bounds write triggers without further interaction, enabling arbitrary code execution with the privileges of the DOPSoft 2 application. In ICS environments, this can lead to compromise of the engineering workstation used for HMI configuration, unauthorized modification of HMI configurations that control physical industrial processes, lateral movement from the engineering network to the operational technology (OT) network, and disruption of industrial process monitoring and control. With an EPSS score of 70.4% (99th percentile), exploitation probability is very high. The end-of-life status of DOPSoft 2 means no patches will be released, creating a permanent vulnerability for organizations that continue to use this software.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-38406 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. CISA's ICS advisory ICSA-21-252-02 provides detailed information about the vulnerability. The EPSS score of 70.4% (99th percentile) reflects very high exploitation probability. The end-of-life status of DOPSoft 2 means the only mitigation is discontinuing use of the product, as no patches will be released. No specific ransomware campaigns are currently associated with this CVE, but ICS-targeting attacks represent a growing threat vector.
Remediation
- Discontinue use of Delta Electronics DOPSoft 2: Per the CISA KEV required action, the impacted product is end-of-life and should be disconnected if still in use. Migrate to a currently supported HMI configuration tool that receives ongoing security updates.
- Do not open untrusted DOPSoft 2 project files: Until migration is complete, never open DOPSoft 2 project files from untrusted or unknown sources. Treat all external project files as potentially malicious.
- Isolate engineering workstations: Place workstations running DOPSoft 2 on isolated network segments, separated from both the corporate IT network and the OT network, with strict access controls.
- Implement application whitelisting: Deploy application whitelisting on engineering workstations to prevent unauthorized code execution even if the DOPSoft 2 vulnerability is triggered.
- Monitor for anomalous activity on ICS workstations: Deploy endpoint detection and response (EDR) solutions on engineering workstations to detect exploitation attempts, unexpected process creation, or modifications to HMI configurations.
Technical Details
CVE-2021-38406 is an out-of-bounds write vulnerability in Delta Electronics DOPSoft 2, which is used for configuring Delta HMI panels in industrial automation environments. The vulnerability exists in the file parsing engine that processes DOPSoft 2 project files (.dop format). When the application parses a specially crafted project file, it fails to properly validate the size and content of certain data fields before writing them to memory. An attacker can create a malicious project file that specifies data sizes that exceed the allocated buffer boundaries, causing the parser to write beyond the buffer into adjacent memory. By carefully controlling the overflow data, the attacker can overwrite function pointers, return addresses, or other critical memory structures to redirect execution flow to shellcode embedded in the project file. As documented in CISA ICS advisory ICSA-21-252-02, the vulnerability requires the victim to open the crafted file, making social engineering or supply chain compromise the primary delivery vectors.
Frequently Asked Questions
Is CVE-2021-38406 being actively exploited?
Yes. CISA has added CVE-2021-38406 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 70.4% (99th percentile) indicates very high exploitation probability. The product is end-of-life and will not receive patches.
What products are affected by CVE-2021-38406?
CVE-2021-38406 affects Delta Electronics DOPSoft 2, an HMI configuration software used in industrial control system environments. The product has reached end-of-life and will not receive security updates from Delta Electronics.
How do I fix CVE-2021-38406?
The only effective remediation is to discontinue use of DOPSoft 2, as the product is end-of-life with no patches available. Migrate to a currently supported HMI configuration tool. In the interim, isolate workstations running DOPSoft 2 and never open project files from untrusted sources.
How severe is CVE-2021-38406?
CVE-2021-38406 is a high severity vulnerability that enables arbitrary code execution through malicious project file parsing. With an EPSS score of 70.4% (99th percentile) and no available patches due to end-of-life status, it poses a persistent threat to ICS environments. Exploitation can compromise engineering workstations and potentially impact industrial control processes.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.