Delta Electronics DOPSoft 2 Out-of-Bounds Write Vulnerability (CVE-2021-38406) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-38406) is an Out-of-Bounds Write (CWE-787) vulnerability in Delta Electronics DOPSoft 2, an HMI screen editor. The root cause lies in the application's failure to properly validate user-supplied data when parsing specific HMI project files. This lack of validation allows input data to write past the allocated buffer boundary, leading to memory corruption and potential control flow hijacking.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts a malicious DOPSoft project file containing anomalous structures designed to trigger the out-of-bounds write during parsing. The attacker then uses social engineering tactics, such as spear-phishing, to deliver the file to an engineer. When the victim opens the file using a vulnerable version of DOPSoft 2, the parsing engine processes the malformed data, corrupts the stack or heap memory, and executes the attacker's payload under the privileges of the running application.

3. Infrastructure & Business Impact

DOPSoft is widely utilized in Industrial Control Systems (ICS) and Operational Technology (OT) environments to configure HMI panels. Because this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, it represents a highly practical and active threat. Compromising an engineering workstation via this vector could allow attackers to manipulate HMI configurations, disrupt physical industrial processes, or establish a foothold for lateral movement within sensitive OT networks.