CVE-2021-38406

Timeline

Detection, updates, and resolution for this record.

1. Sep 17, 2021 · Catalog

   Detected

   Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

2. Aug 25, 2022 · CISA KEV

   Known exploited

   The impacted product is end-of-life and should be disconnected if still in use.

3. Sep 15, 2022 · CISA KEV

   Remediation due

   The impacted product is end-of-life and should be disconnected if still in use.

4. Jun 16, 2026 · Catalog

   Updated

   Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

Affected

• cpe deltaww/dopsoftversion unspecified
• vendor Delta Electronics DOPSoft 2version unspecified

Sources

• CISA KEVCVE-2021-38406

  Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.

  cisa.gov
• CVE.orgCVE-2021-38406

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-38406

  30-day exploitation probability 76.4%

  first.org
• NIST NVDCVE-2021-38406

  Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of t

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Third Party Advisory · us-cert.cisa.gov
• US Government Resource · cisa.gov
• CISA note · cisa.gov