Delta Electronics Delta Industrial Automation DOPSoft DPS File wScreenDESCTextLen Buffer Overflow Remote Code Execution
CVE-2023-43815

7.8HIGH

Key Information:

Vendor
Delta Electronics
Status
DOPSoft
Vendor
CVE Published:
18 January 2024

Summary

A vulnerability exists in Delta Electronics' DOPSoft software, specifically in version 2, related to how the application handles the wScreenDESCTextLen field in DPS files. An attacker can exploit this flaw by crafting a malicious DPS file. If a user opens this file, the exploitation could lead to the execution of arbitrary code, putting the system and its data at risk. This highlights the importance of validating and securing the input files within the software.

Affected Version(s)

DOPSoft 2.00.00.00 <= 2.00.07.04

References

https://blog.exodusintel.com/2024/01/18/delta-electronics...
third-party-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Exodus Intelligence
.