CVE-2021-38406

HIGH KEV

Delta Electronic DOPSoft 2 <2.00.07 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-38406 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 25, 2022.

Description

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02

Scores

CVSS v3 7.8
EPSS 0.6213
EPSS Percentile 98.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-08-25
VulnCheck KEV 2022-08-25
InTheWild.io 2022-08-19
ENISA EUVD EUVD-2021-24858
CWE
CWE-787
Status published
Products (1)
deltaww/dopsoft 2.00 - 2.00.07
Published Sep 17, 2021
KEV Added Aug 25, 2022
Tracked Since Feb 18, 2026