Delta Electronics DOPSoft 2 Out-of-Bounds Write Vulnerability

Historical catalog analysis: CISA added this entry on August 25, 2022. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

Reports from August 2022 identified a vulnerability (CVE-2021-38406) in Delta Electronics DOPSoft 2. The software lacks proper validation of user-supplied data when parsing specific project files. This improper input validation can result in an out-of-bounds write (CWE-787), which could allow for the execution of arbitrary code.

Exposure and applicability

This vulnerability applies to environments utilizing DOPSoft 2, the software used to configure Human Machine Interfaces (HMIs) within industrial automation and SCADA systems. The primary exposure path involves the parsing of malicious project files. Because HMIs serve as the primary interface between operators and the physical process, a compromise of the configuration software could potentially impact the integrity of the HMI deployment.

Remediation priorities

Because Delta Electronics has designated DOPSoft 2 as end-of-life (EOL), there is no official patch available for this vulnerability. Our analysis suggests the following prioritized actions for OT security leaders and controls engineers:

1. Asset Identification: Identify all engineering workstations and laptops where DOPSoft 2 is currently installed.
2. System Isolation: Based on vendor guidance, the impacted product should be disconnected if it is still in use. This includes removing the software from networked workstations to prevent the ingestion of malicious files via network shares or email.
3. Migration Planning: Since the product is EOL, asset owners should evaluate transitioning to supported HMI configuration tools and hardware that receive active security updates.

How to validate remediation

Validation in this case does not involve verifying a patch, but rather confirming the removal of the risk surface. Asset owners can verify remediation by:
* Performing an inventory audit of installed software on all engineering workstations to ensure DOPSoft 2 has been uninstalled or the host system has been decommissioned.
* Verifying that any remaining legacy systems containing the software are physically and logically isolated from the industrial network and the internet.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, because the product is end-of-life, there is a residual risk for any organization that cannot immediately disconnect or replace these systems due to operational dependencies. Users should be aware that simply restricting network access may not eliminate the risk if malicious project files are introduced via removable media.

Source and editorial note

CVE-2021-38406: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability · Source date: August 25, 2022 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: August 28, 2022. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 14, 2026 at 01:33 UTC.

Request an OT security assessment