How severe is CVE-2021-38406?

CVE-2021-38406 has a CVSS 3.1 base score of 7.8 (HIGH). EPSS estimates a 76.4% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2021-38406: Delta Electronics DOPSoft 2 Out-of-Bounds

CISA Known Exploited Vulnerabilities

Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-08-25

Remediation due

2022-09-15

Required action
The impacted product is end-of-life and should be disconnected if still in use.

CISA notes
https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-02; https://nvd.nist.gov/vuln/detail/CVE-2021-38406

Description

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

Severity

CVSS 3.1 · CNA7.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Delta Electronics	DOPSoft 2	unspecified to 2.00.07

References

1 Links

Other references

https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02

Record Details

Published

2021-09-17

Last updated

2025-10-21

Assigner (CNA)

icscert

Credited to

kimiya, working with Trend Micro’s Zero Day Initiative

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-787 · Out-of-bounds Write

Fuzzing Binary Exploitation

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.