CVE-2021-38406

What it actually does

Delta Electronics DOPSoft 2 version 2.00.07 and earlier improperly validates user-controlled data while parsing certain project files. A maliciously crafted project file can trigger out-of-bounds writes in the DOPSoft process, corrupting memory and enabling arbitrary code execution with the privileges of the user running the application. Because the CVSS vector requires local interaction and user interaction, exploitation typically depends on convincing an engineer or operator to open a malicious project file rather than direct network exploitation.

Why it matters to the business

Successful exploitation can compromise engineering workstations used to configure or maintain HMI/industrial control assets. An attacker could steal project files, modify automation configuration, deploy malware, pivot into operational technology networks, or disrupt engineering operations. The vulnerability is listed in CISA KEV with a remediation due date of 2022-09-15 and has high EPSS likelihood, so organizations using affected DOPSoft versions should treat exposure as urgent even though exploitation requires opening a malicious file.

How an attack unfolds

An attacker prepares a malformed DOPSoft project file that abuses missing bounds checks in the project-file parser. The attacker then delivers the file through a channel an engineering user may trust, such as email, shared file transfer, vendor support exchange, removable media, or a compromised project repository. When the user opens the project in DOPSoft 2 version 2.00.07 or earlier, the parser performs out-of-bounds writes, corrupting process memory. With a reliable exploit, the attacker gains code execution in the context of the DOPSoft process and current user. Post-exploitation activity may include launching a shell or scripting interpreter, dropping payloads, harvesting project data and credentials, modifying HMI project content, or using the engineering workstation as a bridge into adjacent IT or OT systems.

How to fix it

Upgrade Delta Electronics DOPSoft to a vendor-supported version that is not affected by this issue; affected versions are DOPSoft 2 version 2.00.07 and earlier. If an exact fixed version is not available from package inventory, consult Delta Electronics/CISA advisories and vendor support for the current corrected release path. Remove or isolate unsupported DOPSoft installations. Until upgraded, do not open project files from untrusted or unverifiable sources, treat externally supplied project files as potentially malicious, and inspect them only in a sandboxed or offline analysis environment. Restrict DOPSoft use to hardened engineering workstations, enforce least-privilege user accounts, block unnecessary internet/email access from engineering hosts, and monitor or prevent DOPSoft from launching command shells, scripting engines, or network utilities.

How to confirm the fix worked

Inventory installed DOPSoft versions and confirm no systems are running DOPSoft 2 version 2.00.07 or earlier. Validate the installed application version from the product UI, installation metadata, software inventory tools, or file properties for the DOPSoft executable. Confirm that engineering workstations have application-control or endpoint rules preventing DOPSoft from spawning suspicious child processes. Test mitigation controls by attempting to open only known-good project files from trusted repositories and verifying that untrusted project-file workflows are blocked or sandboxed. Review vendor release notes or advisories to confirm the deployed version contains the parser fixes for this vulnerability.

Typical attack path

1. Identify organizations or users that use Delta Electronics DOPSoft for HMI/automation engineering.
2. Craft or obtain a malicious DOPSoft project file that triggers the out-of-bounds write condition.
3. Deliver the file through phishing, file-sharing, support workflows, removable media, or a compromised engineering repository.
4. Convince a user to open the project file in an affected DOPSoft 2 installation.
5. Achieve arbitrary code execution in the DOPSoft process under the current user's privileges.
6. Spawn follow-on tools or scripts, drop malware, steal project files, or pivot to other systems.
7. Attempt persistence, credential access, or modification of engineering artifacts if the workstation provides access to operational environments.

How to detect it

Look for evidence that a user opened an untrusted DOPSoft project file followed by abnormal process behavior. Useful sources include EDR process telemetry, Windows Security logs, Sysmon, application-control logs, email gateway logs, web/proxy logs, file-share audit logs, removable-media events, and recent-file artifacts. Prioritize timelines where DOPSoft opened a newly downloaded, emailed, or removable-media project file, then spawned command interpreters, scripting engines, download utilities, archive tools, credential tools, or made unexpected outbound network connections. Search for crashes or exception events involving the DOPSoft executable, especially if followed by process creation. For forensic review, examine user Downloads, email attachment caches, temp directories, recent documents, jump lists, prefetch, shellbags, and EDR file events for suspicious DOPSoft project files. Because exploitation is file-based, there may be no universal network IOC; behavioral detection around DOPSoft child processes and suspicious project-file provenance is the most reliable approach.

• DOPSoft.exe
• DOPSoft 2.00.07
• DOPSoft.exe -> cmd.exe
• DOPSoft.exe -> powershell.exe
• DOPSoft.exe -> wscript.exe
• DOPSoft.exe -> cscript.exe
• DOPSoft.exe -> mshta.exe
• DOPSoft.exe -> rundll32.exe
• DOPSoft.exe -> regsvr32.exe
• DOPSoft.exe -> certutil.exe
• DOPSoft.exe -> bitsadmin.exe
• DOPSoft.exe -> curl.exe
• DOPSoft.exe -> wget.exe
• DOPSoft.exe -> schtasks.exe
• DOPSoft.exe -> net.exe
• DOPSoft.exe -> whoami.exe
• .dop

What your security team should do

• Immediately locate all Delta Electronics DOPSoft installations and prioritize upgrades or removal of DOPSoft 2 version 2.00.07 and earlier.
• Treat this as high priority because it is in CISA KEV, has known in-the-wild exploitation, and has a high EPSS probability despite requiring user interaction.
• Restrict project-file exchange workflows: require trusted sources, integrity verification, malware scanning, and sandbox review for files received from third parties.
• Add endpoint detections for DOPSoft spawning shells, scripting engines, download utilities, archive tools, or unusual network connections.
• Harden engineering workstations with least privilege, application control, EDR coverage, removable-media restrictions, and network segmentation from broader IT and sensitive OT assets.
• Review historical endpoint, proxy, email, and file-share telemetry for suspicious DOPSoft project-file handling and abnormal child processes around the time files were opened.
• If suspicious execution is found, preserve the project file, collect memory/endpoint telemetry where possible, rotate exposed credentials, and assess adjacent engineering and OT systems for lateral movement.