CVE-2021-38406: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability

CVE-2021-38406 is an improper input validation flaw in Delta Electronics DOPSoft 2 that can lead to an out-of-bounds write when the software parses certain project files. Successful abuse can allow code execution on the system running the application. Because DOPSoft 2 is used to engineer and manage industrial human-machine interface (HMI) projects, a compromise can put engineering workstations and connected operational technology environments at risk. The product is end-of-life; defenders should treat any remaining installations as high priority for removal or isolation.

How it works

The weakness is classified as CWE-787 (out-of-bounds write). DOPSoft 2 does not adequately validate user-supplied data while parsing specific project files. An attacker who can supply a crafted project file can trigger a write past the bounds of an allocated buffer. In this class of flaw, that memory corruption can be leveraged to alter program control flow and execute arbitrary code in the context of the application. Public detail on exact file formats or trigger conditions is limited; teams should treat any untrusted or unexpected project file as potentially malicious and confirm technical specifics against the vendor advisory.

Am I affected? How to find it in your systems

DOPSoft 2 is engineering software typically installed on Windows workstations used by control-system engineers and system integrators who develop or maintain Delta HMI projects. It is not normally found on servers or production controllers, but may appear on jump hosts, engineering laptops, or shared design machines.

• Inventory endpoints for the presence of Delta Electronics DOPSoft 2 via software asset management, package inventories, or file-system searches for the application binaries and associated project-file extensions.
• Because the product is end-of-life, any detected installation should be considered affected until proven otherwise; confirm exact status against the vendor advisory.
• Review recent file-open activity, especially project files received from external parties, removable media, or untrusted network shares.
• Look for crash dumps, unexpected process terminations, or anomalous child processes spawned by the DOPSoft executable as possible signs of attempted exploitation; correlate with user reports of malformed project files.

How to remediate

The CISA-required action is clear: the impacted product is end-of-life and should be disconnected if still in use. There is no expectation of further vendor patches for this version line. Remove DOPSoft 2 from all systems, replace it with a currently supported alternative if HMI engineering capability is still required, and ensure project files are migrated only through validated, trusted channels. After removal, verify that no residual services, scheduled tasks, or file associations remain. Confirm final disposition and any migration guidance against the vendor advisory.

If you can't patch immediately

If immediate decommissioning is operationally impossible, apply compensating controls to reduce exposure until the software can be removed:

• Isolate engineering workstations that still run DOPSoft 2 onto tightly controlled network segments with no direct internet access and restricted lateral connectivity to production control networks.
• Block or tightly filter inbound transfer of project files; accept files only from authenticated internal sources after manual inspection.
• Disable automatic file associations and opening of project files from email or web downloads.
• Apply application allow-listing so only approved binaries can execute, and monitor for unexpected process launches from the DOPSoft working directories.
• Increase endpoint detection and logging around the application to alert on crashes, memory-corruption indicators, or anomalous behavior until the software is retired.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to full compromise of the engineering host and subsequent movement into industrial environments. Known ransomware use of this specific CVE is not documented, yet any successful code execution still warrants a full incident-response review of the affected workstation, credential hygiene, and connected systems. If you believe your environment may have been exposed, run a free exposure scan of your email addresses against known breach data sets to check for secondary credential compromise and rotate any credentials that may have been present on the affected hosts.