Delta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesTimeLen Buffer Overflow Remote Code Execution
CVE-2023-43822

7.8HIGH

Key Information:

Vendor
Delta Electronics
Status
DOPSoft
Vendor
CVE Published:
18 January 2024

Summary

A significant stack-based buffer overflow vulnerability exists in Delta Electronics' DOPSoft automation software, specifically when processing the wLogTitlesTimeLen field in a DPS file. This vulnerability allows an unauthenticated remote attacker to exploit the flaw by tricking a user into opening a maliciously crafted DPS file. Successful exploitation can result in remote code execution, potentially compromising the integrity and security of affected systems.

Affected Version(s)

DOPSoft 2.00.00.00 <= 2.00.07.04

References

https://blog.exodusintel.com/2024/01/18/delta-electronics...
third-party-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Exodus Intelligence
.