{"id":"CVE-2021-38406","kind":"vulnerability","aliases":["CVE-2021-38406"],"related":[],"title":"deltaww dopsoft: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing…","description":"Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.\n\nCISA required action: The impacted product is end-of-life and should be disconnected if still in use.","summary":"Delta Electronics DOPSoft 2, an industrial PLC programming tool, mishandles certain project files, causing an out-of-bounds write. An attacker who gets a crafted project file opened can run code on the engineering workstation.","severity":"high","cvss":7.8,"epss":0.76428,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"Delta Electronics DOPSoft 2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"deltaww dopsoft","fixed":[],"affected":">= 2.00, <= 2.00.07","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["delta-electronics","exploited","industrial-control","infrastructure","plc","windows"],"not_affected_if":["dopsoft-not-installed"],"how_to_check":"Check whether DOPSoft 2 is installed on any engineering or HMI workstation, for example by searching for DOPSoft2 in installed programs.","fix":"CISA says the product is end-of-life and should be disconnected if still in use; no patched version is named in the sources.","status":"open","published_at":"2021-09-17T19:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:51+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:10:51Z","model":"claude-haiku-5-5","output":{"fix":"CISA says the product is end-of-life and should be disconnected if still in use; no patched version is named in the sources.\nunknown","reach":"local","impact":"high","summary":"Delta Electronics DOPSoft 2, an industrial PLC programming tool, mishandles certain project files, causing an out-of-bounds write. An attacker who gets a crafted project file opened can run code on the engineering workstation.","category":"infrastructure","who_cares":["industrial-control","plc","windows","delta-electronics"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the engineering workstation via a crafted project file","analyst_note":"Confirm the affected version range and whether a vendor advisory or replacement exists; check https://www.cisa.gov/known-exploited-vulnerabilities-catalog for the required action wording.","how_to_check":"Check whether DOPSoft 2 is installed on any engineering or HMI workstation, for example by searching for DOPSoft2 in installed programs.\nunknown","needs_analyst":true,"not_affected_if":["dopsoft-not-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2877,"output_tokens":421,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':22A,25A '-38406':23A,26A '2':6A,30A,46B,82C '2.00.07':8A 'action':114C 'allow':108C 'attack':64B 'bound':61B,105C 'caus':56B 'certain':53B 'cisa':112C 'code':74B,110C 'control':39B 'craft':68B 'cve':21A,24A 'data':18A,90C 'delta':3A,27A,34B,43B,79C 'delta-electron':33B 'deltaww':1A,31A 'disconnect':126C 'dopsoft':2A,5A,29A,32A,45B,81C 'electron':4A,35B,44B,80C 'electronics':28A 'end':120C 'end-of-lif':119C 'engin':77B 'execut':111C 'exploit':36B 'file':55B,70B,95C 'get':66B 'impact':116C 'improp':96C 'industri':38B,48B 'industrial-control':37B 'infrastructur':40B 'input':97C 'lack':11A,83C 'life':122C 'mishandl':52B 'open':71B 'out-of-bound':58B,102C 'pars':20A,92C 'plc':41B,49B 'prior':10A 'product':117C 'program':50B 'project':54B,69B,94C 'proper':12A,84C 'requir':113C 'result':99C 'run':73B 'specif':93C 'still':128C 'suppli':17A,89C 'tool':51B 'use':130C 'user':16A,88C 'user-suppli':15A,87C 'valid':13A,85C,98C 'version':7A 'window':42B 'workstat':78B 'write':62B,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-17T19:15:08+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-38406","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-38406","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2021-38406","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38406","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-38406","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38406","severity":null,"published_at":"2021-09-17T19:15:08+00:00","modified_at":"2026-06-17T04:02:02+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}