CVE-2021-38406 — Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of t

01What is this vulnerability?

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

02Affected products

Vendor	Product	Versions
Delta Electronics	DOPSoft 2	unspecified

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2022-08-25. Ransomware use: Unknown.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2021-09-17T18:54:29.386Z
• Last modified: 2025-10-21T23:25:32.113Z
• Added to CISA KEV: 2022-08-25
• BOD 22-01 due: 2022-09-15

09References

• us-cert.cisa.gov — https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02