CVE-2021-38406 in deltaww dopsoft
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
Affected software: deltaww dopsoft
Scores
- CVSS: 7.8 (high)
- EPSS: 76.43% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-08-25
- Published: 2021-09-17
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Retire Delta DOPSoft 2 and move to DIAScreen (DIAStudio 1.1.2 or later)
Isolate the system. DOPSoft 2 is end-of-life and will not get a fix for its project-file parsing flaws (CVE-2021-38406), so remove it and move HMI projects to DIAScreen in DIAStudio. Until you have done that, keep it on isolated engineering workstations and open only trusted project files.
Applies to: Delta Electronics DOPSoft 2, version 2.00.07 and earlier (end-of-life, no fix will be released).
- List every engineering workstation that has Delta DOPSoft 2 installed (Control Panel, Programs and Features, or your software inventory). All versions up to and including 2.00.07 are affected, and there will be no fixed version.
- Plan the migration Delta recommends: move HMI devices to the DOP-100 family and engineer them with DIAScreen in DIAStudio v1.1.2 or later (download from the Delta Electronics download center, login required).
- Install DIAStudio v1.1.2 or later, convert or rebuild the HMI projects, and check them on a test HMI.
- Uninstall DOPSoft 2 from every workstation (Programs and Features, DOPSoft 2, Uninstall).
- If DOPSoft 2 must stay for a while, disconnect the workstation from the internet and from email, and put it in an isolated engineering network segment that is reachable only from the OT zone.
- Until it is removed, open only DOPSoft project files from trusted sources. Do not open project files that arrive by email, USB stick or download without first checking where they came from.
- Check that no workstation still has DOPSoft 2 installed by running a software inventory or doing a manual check.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.